Vulnerability record · CVE-2023-34967 · published 20 July 2023
CVE-2023-34967: Samba mdssvc RPC type confusion crashes shared worker process
Samba · Samba
Samba's mdssvc RPC service for Spotlight lacks type checking in callers of dalloc_value_for_key(), so a crafted key-value dictionary in an mdssvc packet can pass an invalid pointer to talloc_get_size(). Because the RPC worker process is shared across client connections, one malicious client can crash it and disrupt all other clients it serves.
Description
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Automated analysis
medium priorityThe flaw is remotely reachable without authentication and can disrupt a shared worker, but it only causes a crash with low availability impact and no documented in-the-wild exploitation.
What it is
Samba's mdssvc RPC service for Spotlight lacks type checking in callers of dalloc_value_for_key(), so a crafted key-value dictionary in an mdssvc packet can pass an invalid pointer to talloc_get_size(). Because the RPC worker process is shared across client connections, one malicious client can crash it and disrupt all other clients it serves.
Impact
An attacker gains a denial of service: the shared mdssvc RPC worker process crashes, interrupting Spotlight queries for every client using that worker. The CVSS vector shows no confidentiality or integrity impact, only low availability impact.
Attack surface
Reached over the network via the mdssvc RPC service; the CVSS vector indicates no privileges and no user interaction are required. Any client able to send mdssvc RPC packets to the Samba service can attempt it.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at 0.612 (99th percentile), suggesting elevated likelihood of exploitation activity. References are advisories and errata only, with no public exploit tag.
What to do
- Apply the Samba security update for CVE-2023-34967 and the corresponding vendor errata (Red Hat RHSA-2023:6667/7139, RHSA-2024:0423/0580, Debian DSA-5477, Fedora updates).
- If Spotlight/mdssvc is not needed, disable the Spotlight RPC service or restrict access to it.
- Limit network exposure of SMB/RPC services to trusted clients and segments.
- Monitor for repeated mdssvc worker crashes and restart loops as a sign of attempted abuse.
Detection
- Alert on Samba mdssvc worker process crashes or abnormal restarts in service logs.
- Monitor for repeated or malformed mdssvc RPC traffic from single clients.
- Correlate SMB/RPC connection bursts with worker process termination events.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-34967 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-34967), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
