CVE-2023-6780: Glibc: integer overflow in __vsyslog_internal()
An integer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/glibcto a version that resolves this vulnerability.Fixed in 2.38-1ubuntu6.1 - Upgrade
Upgrade
ubuntu/glibcto a version that resolves this vulnerability.Fixed in 2.37-15 - Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.28-10+deb10u1Fixed in 2.28-10+deb10u2Fixed in 2.31-13+deb11u8Fixed in 2.31-13+deb11u7Fixed in 2.36-9+deb12u4Fixed in 2.37-15Fixed in 2.37-17 - Upgrade
Upgrade
redhat/glibcto a version that resolves this vulnerability.Fixed in 2.39
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6780?
CVE-2023-6780 has been classified as a critical vulnerability due to its potential for remote code execution and system compromise.
How do I fix CVE-2023-6780?
To mitigate CVE-2023-6780, update the GNU C Library (glibc) to version 2.38 or later.
Which versions of glibc are affected by CVE-2023-6780?
CVE-2023-6780 impacts glibc versions 2.36 and 2.37.
What exploitation methods exist for CVE-2023-6780?
CVE-2023-6780 can be exploited through remote code execution via crafted syslog and vsyslog calls.
Is CVE-2023-6780 present in any major Linux distributions?
Yes, CVE-2023-6780 affects several major Linux distributions, including Ubuntu, Debian, and Fedora.