CVE-2023-34966
Highsamba: infinite loop in mdssvc RPC service for spotlight
Published Aug 1, 2023 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2023-34966, UBUNTU-CVE-2023-34966, USN-7582-1
Key Facts
Patch immediately- CVE-2023-34966 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Samba, Debian Linux, Fedora (Fedoraproject) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 62% probability of exploitation in the next 30 days.
- Fixed versions are available, including ctdb 2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2, ctdb 2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1, ctdb 4.13.13+git.643.8caa136952b-150200.3.26.3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
62%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-34966 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition.
Affected Products
625 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SambaSamba | See advisory | 4.16.11 |
| Debian LinuxDebian | 11.0, 12.0 | n/a |
| FedoraFedoraproject | 37, 38 | n/a |
| Enterprise LinuxRedhat | 8.0, 9.0 | n/a |
| 8Enterprise Linux | See advisory | n/a |
Patched Releases
ctdb
2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2, 2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1, 4.13.13+git.643.8caa136952b-150200.3.26.3, 4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
ctdb-pcp-pmda
4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
evolution-mapi
3.28.3-8.el8, 3.40.1-6.el9
evolution-mapi-langpacks
3.28.3-8.el8, 3.40.1-6.el9
libdcerpc-binding0
4.13.13+git.643.8caa136952b-150200.3.26.3
libdcerpc0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr-krb5pac0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr-nbt0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr-standard0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr1
4.13.13+git.643.8caa136952b-150200.3.26.3
libnetapi
2:4.17.10-0.amzn2023.0.1, 4.18.6-100.el9
libnetapi-devel
2:4.17.10-0.amzn2023.0.1, 4.18.6-100.el9
libnetapi0
4.13.13+git.643.8caa136952b-150200.3.26.3
libnss-winbind
2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13, 2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2, 2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1
libpam-smbpass
2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13
libpam-winbind
2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13, 2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2, 2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1
libparse-pidl-perl
2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13, 2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2, 2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1
libsamba-credentials0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-errors0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-hostconfig0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-passdb0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-policy-devel
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-policy-python3-devel
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-policy0-python3
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-policy0-python3-32bit
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
Timeline
Publicly disclosed
Aug 1, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
References
- advisoryRHSA-2023:6667
- advisoryRHSA-2023:7139
- advisoryhttps://access.redhat.com/security/cve/CVE-2023-34966
- advisoryRHBZ#2222793
- advisoryhttps://bugzilla.suse.com/1212375
FAQ
Common Questions.
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight.
Affected: Samba; Debian Linux versions 11.0, 12.0; Fedora (Fedoraproject) versions 37, 38, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ctdb 2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2, ctdb 2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1, ctdb 4.13.13+git.643.8caa136952b-150200.3.26.3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-34966 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo