Security readout for executives and security teams
Plain-English summary
CVE-2023-34967 is a Samba denial-of-service issue in the Spotlight mdssvc RPC service. A network client can send malformed mdssvc data that crashes a shared RPC worker process, disrupting other clients served by that worker. The provided sources rate it medium, with availability impact only.
Executive priority
Treat this as a moderate service-availability risk. It is not described as code execution or data compromise, but unauthenticated network reachability makes patching important for file services relied on by users or business workflows.
Technical view
The flaw is a type confusion in Samba mdssvc packet parsing. Callers of dalloc_value_for_key() lack type checks, allowing an unexpected object type to reach talloc_get_size(), where Samba can crash after detecting an invalid talloc pointer. CVSS is 5.3: network reachable, low complexity, no privileges, no user interaction, low availability impact.
Likely exposure
Exposure is most likely where Samba provides Spotlight/mdssvc functionality to network clients. The bundle identifies affected Red Hat samba packages for RHEL 8, RHEL 8.6/8.8 EUS, RHEL 9, and Red Hat Virtualization 4 on RHEL 8. RHEL 6, RHEL 7, and Red Hat Storage 3 status is listed as unknown.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. A malicious client or attacker able to reach the mdssvc RPC service may trigger a worker process crash. The evidence supports denial of service against shared worker availability, not data theft, privilege escalation, or code execution.
Researcher notes
Focus validation on Samba mdssvc RPC parsing paths and type assumptions around dalloc_value_for_key(). The bundle’s strongest evidence is process crash behavior when talloc_get_size() receives an invalid talloc pointer. Affected product data is strongest for listed Red Hat samba packages; some older Red Hat products are marked unknown.
Mitigation direction
- Apply vendor Samba updates from the relevant Red Hat, Samba, Debian, Fedora, or NetApp advisory.
- Prioritize internet-exposed or broadly reachable Samba servers offering Spotlight/mdssvc functionality.
- Restrict Samba access to trusted clients and networks while patching is scheduled.
- Check vendor guidance before relying on any workaround not named in your platform advisory.
Validation and detection
- Inventory Samba hosts and identify whether Spotlight/mdssvc functionality is enabled or exposed.
- Compare installed samba package versions with the affected Red Hat versions in the source bundle.
- Confirm applicable vendor errata or security updates have been installed successfully.
- Review logs for unexplained mdssvc or RPC worker crashes affecting multiple clients.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-843: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-34967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2023:6667CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7139CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0423CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0580CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-34967CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2222794CVE reference · issue-tracking, x_refsource_REDHAT
- https://www.samba.org/samba/security/CVE-2023-34967.htmlCVE reference
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPCSGND7LO467AJGR5DYBGZLTCGTOBCC/CVE reference · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OT74M42E6C36W7PQVY3OS4ZM7DVYB64Z/CVE reference · x_transferred
- https://security.netapp.com/advisory/ntap-20230731-0010/CVE reference · x_transferred
- https://www.debian.org/security/2023/dsa-5477CVE reference · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Access of Resource Using Incompatible Type ('Type Confusion')
Access of Resource Using Incompatible Type ('Type Confusion') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.