CVE-2023-34967
Mediumsamba: type confusion in mdssvc RPC service for spotlight
Published Aug 1, 2023 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2023-34967, UBUNTU-CVE-2023-34967
Key Facts
Patch immediately- CVE-2023-34967 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Samba, Debian Linux, Fedora (Fedoraproject) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 61% probability of exploitation in the next 30 days.
- Fixed versions are available, including ctdb 4.13.13+git.643.8caa136952b-150200.3.26.3, ctdb 4.15.13+git.621.c8ae836ff82-3.85.1, ctdb 4.15.13+git.663.9c654e06cdb-150300.3.57.5.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS (30-day exploit likelihood)
61%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-34967 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
Affected Products
555 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SambaSamba | See advisory | 4.16.11 |
| Debian LinuxDebian | 11.0, 12.0 | n/a |
| FedoraFedoraproject | 37, 38 | n/a |
| Enterprise LinuxRedhat | 8.0, 9.0 | n/a |
| 8Enterprise Linux | See advisory | n/a |
Patched Releases
ctdb
4.13.13+git.643.8caa136952b-150200.3.26.3, 4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
ctdb-pcp-pmda
4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
evolution-mapi
3.28.3-8.el8, 3.40.1-6.el9
evolution-mapi-langpacks
3.28.3-8.el8, 3.40.1-6.el9
libdcerpc-binding0
4.13.13+git.643.8caa136952b-150200.3.26.3
libdcerpc0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr-krb5pac0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr-nbt0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr-standard0
4.13.13+git.643.8caa136952b-150200.3.26.3
libndr1
4.13.13+git.643.8caa136952b-150200.3.26.3
libnetapi
2:4.17.10-0.amzn2023.0.1, 4.18.6-100.el9
libnetapi-devel
2:4.17.10-0.amzn2023.0.1, 4.18.6-100.el9
libnetapi0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-credentials0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-errors0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-hostconfig0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-passdb0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamba-policy-devel
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-policy-python3-devel
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-policy0-python3
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150300.3.57.5, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-policy0-python3-32bit
4.15.13+git.621.c8ae836ff82-3.85.1, 4.15.13+git.663.9c654e06cdb-150400.3.28.1, 4.17.9+git.367.dae41ffdd1f-150500.3.5.1, 4.18.5+git.313.c8e274c7852-1.1
libsamba-util0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsamdb0
4.13.13+git.643.8caa136952b-150200.3.26.3
libsmbclient
2:4.17.10-0.amzn2023.0.1, 4.18.6-100.el9
libsmbclient-devel
2:4.17.10-0.amzn2023.0.1, 4.18.6-100.el9
Timeline
Publicly disclosed
Aug 1, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
References
- advisoryRHSA-2023:6667
- advisoryRHSA-2023:7139
- advisoryhttps://access.redhat.com/security/cve/CVE-2023-34967
- advisoryhttps://bugzilla.suse.com/1212375
- advisoryhttps://bugzilla.suse.com/1213170
FAQ
Common Questions.
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight.
Affected: Samba; Debian Linux versions 11.0, 12.0; Fedora (Fedoraproject) versions 37, 38, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ctdb 4.13.13+git.643.8caa136952b-150200.3.26.3, ctdb 4.15.13+git.621.c8ae836ff82-3.85.1, ctdb 4.15.13+git.663.9c654e06cdb-150300.3.57.5.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-34967 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo