Vulnerability record · CVE-2023-34966 · published 20 July 2023
CVE-2023-34966: Samba mdssvc Spotlight RPC infinite loop denial of service
Samba · Samba
Samba's mdssvc RPC service for Spotlight fails to validate the element count field in array-like structures when unmarshalling RPC packets. Passing a count of 0 causes sl_unpack_loop() to loop endlessly, consuming 100% CPU. This lets a remote unauthenticated client deny service on affected Samba deployments.
Description
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote unauthenticated availability impact with a 7.5 CVSS score and very high EPSS probability, though no confirmed in-the-wild exploitation or KEV listing.
What it is
Samba's mdssvc RPC service for Spotlight fails to validate the element count field in array-like structures when unmarshalling RPC packets. Passing a count of 0 causes sl_unpack_loop() to loop endlessly, consuming 100% CPU. This lets a remote unauthenticated client deny service on affected Samba deployments.
Impact
An attacker can pin a CPU core at 100% indefinitely, degrading or halting the mdssvc service and potentially the host. No data is read or modified; the effect is availability loss only.
Attack surface
Reached over the network via the mdssvc RPC service, per the CVSS vector AV:N/PR:N/UI:N, so no authentication or user interaction is required. The attacker only needs to send a malformed Spotlight RPC request with a zero array count.
Exploitation
Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.62402 (99.1st percentile), indicating high predicted exploitation activity. References are vendor and distro advisories only, with no public exploit tag.
What to do
- Apply the Samba security update for CVE-2023-34966 or the corresponding Red Hat, Fedora, Debian or NetApp errata.
- If Spotlight/mdssvc is not needed, disable the mdssvc service or block its RPC endpoint.
- Restrict network access to Samba RPC ports (445/139) to trusted hosts and segments.
- Monitor CPU usage on Samba hosts and rate-limit or drop malformed RPC traffic at the perimeter.
Detection
- Alert on sustained near-100% CPU on smbd processes, especially correlated with mdssvc RPC traffic.
- Inspect SMB/RPC logs for Spotlight mdssvc requests containing zero or anomalous array count fields.
- Baseline normal mdssvc request rates and flag spikes or repeated malformed packets from a single source.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-34966 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-34966), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
