CVE-2023-34967
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. The issue occurs when parsing Spotlight mdssvc RPC packets, potentially leading to a crash of the mdssvc worker process when a malicious client calls the dalloc_value_for_key() function.
Risk Assessment
This vulnerability can lead to a crash of the worker process, affecting all clients using the same service. A malicious client can exploit this flaw to disrupt service for other users.
Recommendation
It is recommended to update Samba to the latest version that includes security fixes. Additionally, monitor logs and restrict access to the mdssvc service only to trusted clients.
Original NVD description (English source)
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.