CVE-2023-34967: Samba: type confusion in mdssvc rpc service for spotlight

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 61.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-20 · updated 2026-06-17
Weakness: CWE-843

Description

A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.

Affected products

Debian Linux: 11.0, 12.0
Fedoraproject Fedora: 37, 38
Red Hat Enterprise Linux: 8.0, 9.0
Samba: before 4.16.11; from 4.17.0 before 4.17.10; from 4.18.0 before 4.18.5 — fixed in 4.16.11, 4.17.10, 4.18.5

How to fix

Upgrade to a fixed version: Samba 4.16.11, 4.17.10, 4.18.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-34967 or the next vulnerability affects your stack