Samba: smbd allows client access to unix domain sockets on the file system as root

CVE-2023-3961

Summary

A vulnerability in Samba has been identified where inadequate sanitization of client pipe names allows for path traversal via Unix directory traversal characters. This flaw may permit attackers to connect SMB clients as root to Unix domain sockets beyond designated private directories. As a result, if a malicious client sends a crafted pipe name that resolves to an external service using an existing Unix domain socket, this could lead to unauthorized service access, potentially resulting in compromise or service disruptions.

References