Glibc: integer overflow in __vsyslog_internal()
CVE-2023-6780

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Glibc
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
31 January 2024

What is CVE-2023-6780?

An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.

Affected Version(s)

glibc 2.39

References

http://packetstormsecurity.com/files/176932/glibc-syslog-...
http://seclists.org/fulldisclosure/2024/Feb/3
https://access.redhat.com/security/cve/CVE-2023-6780
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Qualys Threat Research Unit for reporting this issue.
.
CVE-2023-6780 : Glibc: integer overflow in __vsyslog_internal()