CVE-2023-34966High· 7.5▾ TwilightAn infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 12.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
62%
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.
samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)sambasamba4sambasambaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
As a possible workaround, disable Spotlight by removing all configuration stanzas ("spotlight=yes|true") that enable Spotlight .
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-34967Medium· 5.3Samba: type confusion in mdssvc rpc service for spotlight
CVE-2023-34968Medium· 5.3Samba: spotlight server-side share path disclosure
CVE-2022-2127Medium· 5.9Samba: out-of-bounds read in winbind auth_crap
CVE-2023-4091Medium· 6.5Samba: smb clients can truncate files with read-only permissions
CVE-2023-42670Medium· 6.5Samba: ad dc busy rpc multiple listener dos
CVE-2023-3961Critical· 9.1Samba: smbd allows client access to unix domain sockets on the file system as root