Samba mdssvc RPC Type Confusion Crash
CVE-2023-34967 Published on July 20, 2023

Samba: type confusion in mdssvc rpc service for spotlight
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-34967 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Timeline

Reported to Red Hat.

Made public. 6 days later.

Weakness Type

What is an Object Type Confusion Vulnerability?

The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CVE-2023-34967 has been classified to as an Object Type Confusion vulnerability or weakness.


Products Associated with CVE-2023-34967

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-34967 are published in these products:

Canonical Ubuntu Linux
 
Samba
 
Fedora Project Fedora
 
Red Hat Enterprise Linux (RHEL)
 
Debian Linux
 
Red Hat Rhel Eus
 
Red Hat Rhev Hypervisor
 
Red Hat Storage
 

Affected Versions

Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.6 Extended Update Support: Red Hat Enterprise Linux 8.8 Extended Update Support: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Storage 3:

Exploit Probability

EPSS
21.17%
Percentile
95.56%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.