CVE-2023-34966
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A vulnerability was found in Samba's mdssvc RPC service that leads to an infinite loop. The issue occurs when parsing RPC packets sent by the client, where an unvalidated field can lead to 100% CPU usage.
Risk Assessment
This vulnerability can lead to a denial of service condition, affecting system availability and potentially disrupting other services within the organization.
Recommendation
It is recommended to update Samba software to the latest version to mitigate this vulnerability and to monitor systems for unusual RPC traffic patterns.
Original NVD description (English source)
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.