Log in Start free

Vulnerability · Published Jan 31, 2024 · Assigned by redhat

CVE-2023-6246Glibc: heap-based buffer overflow in __vsyslog_internal()

High 8.4

In plain English

A high-severity heap buffer overflow in Fedora from Fedora. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)4.8%top 8.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glibc2.36-9+deb12u4DEBIAN-CVE-2023-6246
Debian:12glibc2.36-9+deb12u4DSA-5611-1
Debian:13glibc2.37-15DEBIAN-CVE-2023-6246
Debian:14glibc2.37-15DEBIAN-CVE-2023-6246
Ubuntu:24.04:LTSglibc2.39-0ubuntu1UBUNTU-CVE-2023-6246

Affected products (as reported)

VendorProductVersions
n/a glibc see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Fedora Fedora see references

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References