Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
CVE-2023-6779

8.2HIGH

Key Information:

Vendor

Red Hat
Status
Glibc
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
31 January 2024

Badges

đź“° News Worthy

What is CVE-2023-6779?

An off-by-one heap-based buffer overflow was identified in the __vsyslog_internal function within the glibc library. When the syslog and vsyslog functions are invoked with a message exceeding INT_MAX bytes, it leads to improper calculations of the buffer size allocated for the message. This flaw may cause application crashes and can potentially be exploited if the affected functions are manipulated. The vulnerability impacts glibc versions 2.37 and newer, necessitating immediate attention from system administrators and software developers utilizing this library.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

glibc 2.39

News Articles

favicon imageQualys Security Blog

Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog() | Qualys Security Blog

The Qualys Threat Research Unit (TRU) has recently unearthed four significant vulnerabilities in the GNU C Library, a cornerstone for countless applications in…

References

http://packetstormsecurity.com/files/176932/glibc-syslog-...
http://seclists.org/fulldisclosure/2024/Feb/3
https://access.redhat.com/security/cve/CVE-2023-6779
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • đź“°

    First article discovered by Qualys Security Blog

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Qualys Threat Research Unit for reporting this issue.
JSON
.