CVE-2023-34966

HIGH

7.5

Description

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/20/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

debian:debian_linuxfedoraproject:fedoraredhat:enterprise_linuxsamba:samba

Weaknesses (CWE)

CWE-835CWE-835

References

https://access.redhat.com/errata/RHSA-2023:6667(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2023:7139(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:0423(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:0580(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:4101(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2023-34966(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2222793(secalert@redhat.com)

https://www.samba.org/samba/security/CVE-2023-34966(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2023:6667(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2023:7139(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2024:0423(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2024:0580(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2024:4101(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/security/cve/CVE-2023-34966(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=2222793(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20230731-0010/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2023/dsa-5477(af854a3a-2127-422b-91ae-364da2661108)

https://www.samba.org/samba/security/CVE-2023-34966(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.