Log in Start free

Vulnerability · Published Jan 31, 2024 · Assigned by redhat

CVE-2023-6779Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

High 8.2

In plain English

A high-severity heap buffer overflow in Fedora from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)3.2%top 12.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glibc2.36-9+deb12u4DEBIAN-CVE-2023-6779
Debian:12glibc2.36-9+deb12u4DSA-5611-1
Debian:13glibc2.37-15DEBIAN-CVE-2023-6779
Debian:14glibc2.37-15DEBIAN-CVE-2023-6779
Ubuntu:24.04:LTSglibc2.39-0ubuntu1UBUNTU-CVE-2023-6779

Affected products (as reported)

VendorProductVersions
n/a glibc see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Fedora Fedora see references

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References