Heap-based Buffer Overflow in GNU C Library's Syslog Function

CVE-2022-39046

Summary

An issue exists in the GNU C Library (glibc) version 2.36 where the syslog function can be exploited when provided with a crafted input string exceeding 1024 bytes. This vulnerability allows the function to read uninitialized memory from the heap, which can lead to unintended information disclosure when the contents of this memory are logged. Consequently, sensitive data stored in the heap may be inadvertently exposed through log files, potentially compromising the system's security.

References