patch releases for Samba 4.10.8 and 4.9.13, which address (), allowing a user to access the root directory where the Samba share is located. The issue occurs when the configuration options 'wide links = yes' are used together with 'unix extensions = no' or 'allow insecure wide links = yes'. Access to files outside the current shared directory is restricted by user permissions, meaning an attacker could read and write files according to their uid/gid.
The problem is caused by the fact that after the first request to the root of the share, the client is returned an access error, but smbd caches the directory call and does not clear the cache in case of an access issue. Accordingly, after sending a repeated SMB request, it is processed successfully based on the cached entry without rechecking permissions.
Source: opennet.ru
