CVEvulnerability

CVE-2023-34966

7.5 HIGH Published 2023-07-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835

Description

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.

Affected configurations

• samba samba (< 4.16.11) • samba samba (>= 4.17.0 < 4.17.10) • samba samba (>= 4.18.0 < 4.18.5) • fedoraproject fedora 37 • fedoraproject fedora 38 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • debian debian linux 11.0 • debian debian linux 12.0

Related

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References