Description
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Storage 3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.19.1+dfsg-1 | — |
| Debian 13 | samba | 2:4.19.1+dfsg-1 | — |
| Debian 12 | samba | 2:4.17.12+dfsg-0+deb12u1 | DSA-5525-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | ctdb +33 | 4.18.6-101.el9_3 | RHSA-2023:6744 |
| RHEL 8 | ctdb +33 | 4.18.6-2.el8_9 | RHSA-2023:7467 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | samba +5 | 4.15.5-13.el8_6 | RHSA-2023:7408 |
| RHEL 9.2 EUS | ctdb +33 | 4.17.5-104.el9_2 | RHSA-2023:7371 |
| RHEL 9.0 EUS | ctdb +23 | 4.15.5-111.el9_0 | RHSA-2023:6209 |
| RHEL 8.8 EUS | ctdb +33 | 4.17.5-4.el8_8 | RHSA-2023:7464 |
| RHEL 8.6 EUS | ctdb +24 | 4.15.5-13.el8_6 | RHSA-2023:7408 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | ctdb +33 | 4.18.6-101.el9_3.alma.1 | ALSA-2023:6744 |
| AlmaLinux 8 | ctdb +33 | 4.18.6-2.el8_9.alma.1 | ALSA-2023:7467 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | samba | 4.17.9+git.421.abde31ca5c2-150500.3.11.1 | SUSE-SU-2023:4046-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | samba | 4.17.9+git.421.abde31ca5c2-150500.3.11.1 | SUSE-SU-2023:4046-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.19.1+git.312.c912b3d2ef6-1.1 | openSUSE-SU-2024:13332-1 |
| openSUSE Leap 15.5 | samba | 4.17.9+git.421.abde31ca5c2-150500.3.11.1 | SUSE-SU-2023:4046-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | samba | 4.18.8-r0 | — |
| Alpine v3.23 | samba | 4.18.8-r0 | — |
| Alpine v3.22 | samba | 4.18.8-r0 | — |
| Alpine v3.21 | samba | 4.18.8-r0 | — |
| Alpine v3.20 | samba | 4.18.8-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | samba | 4.18.8-r0 | — |
| Alpine v3.18 | samba | 4.18.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | samba +31 | 2:4.17.12-1.amzn2023.0.1 | ALAS2023-2023-416 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | samba | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | samba | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | samba +32 | 4.18.6-101.el9_3 | ELSA-2023-6744 |
| Oracle Linux 8 | ctdb +34 | 4.18.6-2.0.1.el8_9 | ELSA-2023-7467 |
Advisories 18
- ALSA-2023:6744 Moderate: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:7467 Moderate: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2025-0168 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- RHSA-2023:7464 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2023:7467 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2023:7408 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2023:7371 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2023:6744 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- RHSA-2023:6209 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jul 28, 2026
- DSA-5525-1 samba - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13332-1 ctdb-4.19.1+git.312.c912b3d2ef6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4046-1 Security update for samba SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-2620 Samba: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 9, 2025
- NCSC-2025-0026 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2024-0523 SolarWinds Security Event Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- ELSA-2023-7467 Moderate: samba security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 23, 2023
- ELSA-2023-6744 Moderate: samba security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 16, 2023
- ALAS2023-2023-416 Important: samba security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 3, 2023
References
- RHSA-2023:6209 vendor-advisory
- RHSA-2023:6744 vendor-advisory
- RHSA-2023:7371 vendor-advisory
- RHSA-2023:7408 vendor-advisory
- RHSA-2023:7464 vendor-advisory
- RHSA-2023:7467 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3961 vdb-entry
- RHBZ#2241881 issue-tracking
- https://bugzilla.samba.org/show_bug.cgi?id=15422
- https://www.samba.org/samba/security/CVE-2023-3961.html