CVE-2023-34967Medium· 5.3▾ SunlitA Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the val…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 12.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
61%
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)samba (all versions)sambasamba4sambasambaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
As a possible workaround, disable Spotlight by removing all configuration stanzas ("spotlight=yes|true") that enable Spotlight .
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-34966High· 7.5Samba: infinite loop in mdssvc rpc service for spotlight
CVE-2023-34968Medium· 5.3Samba: spotlight server-side share path disclosure
CVE-2022-2127Medium· 5.9Samba: out-of-bounds read in winbind auth_crap
CVE-2023-4091Medium· 6.5Samba: smb clients can truncate files with read-only permissions
CVE-2023-42670Medium· 6.5Samba: ad dc busy rpc multiple listener dos
CVE-2023-3961Critical· 9.1Samba: smbd allows client access to unix domain sockets on the file system as root