CVE-2023-34966
high-risk
Published 2023-07-20
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.
Do I need to act?
!
15.9% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (7)
Affected Vendors
References (20)
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6667
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7139
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-34966
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2222793
Vendor Advisory
https://www.samba.org/samba/security/CVE-2023-34966
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6667
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7139
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-34966
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2222793
Vendor Advisory
https://www.samba.org/samba/security/CVE-2023-34966
53
/ 100
high-risk
Severity
26/34 · High
Exploitability
13/34 · Low
Exposure
14/34 · Moderate