CVE-2023-6246: Glibc: heap-based buffer overflow in __vsyslog_internal()
A heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Other sources
Glibc: heap-based buffer overflow in vsysloginternal()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/glibcto a version that resolves this vulnerability.Fixed in 2.38-1ubuntu6.1 - Upgrade
Upgrade
ubuntu/glibcto a version that resolves this vulnerability.Fixed in 2.37-15 - Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.28-10+deb10u1Fixed in 2.28-10+deb10u2Fixed in 2.31-13+deb11u8Fixed in 2.31-13+deb11u7Fixed in 2.36-9+deb12u4Fixed in 2.37-15Fixed in 2.37-17 - Upgrade
Upgrade
redhat/glibcto a version that resolves this vulnerability.Fixed in 2.39
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6246?
CVE-2023-6246 has been classified as a high severity vulnerability due to its potential impact on affected systems.
How do I fix CVE-2023-6246?
To mitigate CVE-2023-6246, update the glibc library to version 2.39 or later.
Which software versions are affected by CVE-2023-6246?
CVE-2023-6246 impacts glibc versions 2.36 and 2.37.
What type of vulnerability is CVE-2023-6246?
CVE-2023-6246 is a heap-based buffer overflow vulnerability.
What functions are primarily associated with CVE-2023-6246?
CVE-2023-6246 is related to the __vsyslog_internal function and the logging functions called within the glibc library.