CVE-2023-34967 Samba: type confusion in mdssvc rpc service for spotlight
A type confusion flaw in Samba's mdssvc RPC service allows a malicious client to crash the shared worker process, causing denial of service for other clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34967?
CVE-2023-34967 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 20 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
Weakness: CWE-843
Which versions are affected by CVE-2023-34967?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Redhat Enterprise Linux, Samba Samba.
How do I fix CVE-2023-34967?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-34967 being exploited?
There is no known exploitation of CVE-2023-34967 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-27660, AZL-37022, CLSA-2025-1738266573, DEBIAN-CVE-2023-34967, ECHO-22dd-0ea0-621b, GHSA-86p4-vhr6-2vv3 and 1 more.