CVE-2023-34966: Samba: infinite loop in mdssvc rpc service for spotlight

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 62.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-20 · updated 2026-06-17
Weakness: CWE-835

Description

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.

Affected products

Debian Linux: 11.0, 12.0
Fedoraproject Fedora: 37, 38
Red Hat Enterprise Linux: 8.0, 9.0
Samba: before 4.16.11; from 4.17.0 before 4.17.10; from 4.18.0 before 4.18.5 — fixed in 4.16.11, 4.17.10, 4.18.5

How to fix

Upgrade to a fixed version: Samba 4.16.11, 4.17.10, 4.18.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-34966 or the next vulnerability affects your stack