Updated: 2024-09-16 21:22:55.83065
Description:
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | 0 | |
| CVSS Version 3.x | MEDIUM | 5.3 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated |
|---|---|---|---|---|---|---|---|
| CentOS 6 ELS | samba | 3.6.23 | 5.3 | MEDIUM | Ignored | 2023-08-01 03:38:12 | |
| CentOS 7 ELS | samba | 4.10.16 | 5.3 | MEDIUM | Ignored | 2024-06-25 11:20:13 | |
| CentOS 8.4 ELS | samba | 4.13.3-5 | 5.3 | MEDIUM | Released | CLSA-2024:1723483357 | 2024-08-12 14:42:27 |
| CentOS 8.5 ELS | samba | 4.14.5-7 | 5.3 | MEDIUM | Released | CLSA-2024:1723058766 | 2024-08-07 17:45:33 |
| CloudLinux 6 ELS | samba | 3.6.23 | 5.3 | MEDIUM | Ignored | 2023-08-01 03:38:12 | |
| Oracle Linux 6 ELS | samba | 3.6.23 | 5.3 | MEDIUM | Ignored | 2023-08-01 03:38:12 | |
| Ubuntu 16.04 ELS | samba | 4.3.11 | 5.3 | MEDIUM | Ignored | 2023-08-01 03:38:12 | |
| Ubuntu 18.04 ELS | samba | 4.7.6 | 5.3 | MEDIUM | Ignored | 2023-08-01 03:38:12 |