CVE-2023-4527: GNU glibc stack read overflow in getaddrinfo

CVE-2023-4527 · Severity: medium · CVSS 6.5 · Published 2023-09-18

A security vulnerability has been identified in glibc, a fundamental software library used by almost all Linux-based systems to perform basic operations like looking up website addresses. Under specific configurations, an attacker could send a specially crafted network response that causes a program to crash or potentially leak sensitive internal memory information. This could lead to service outages or provide attackers with data that helps them bypass other security protections.

Technologies: Gnu Glibc, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Gnu, Red Hat.

Quick answers

Is CVE-2023-4527 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-4527 being exploited in the wild.
How severe is CVE-2023-4527?
Medium severity, with a CVSS score of 6.5, published 18 September 2023.
Which products and versions are affected?
Gnu Glibc up to (excluding) 2.39, 2.36 up to (excluding) 2.36.113, 2.37 up to (excluding) 2.37.38, 2.38 up to (excluding) 2.38.19; Red Hat Enterprise Linux 8 2.28-225.el8_8.6; Red Hat Enterprise Linux 9 9.2, 9.4, 9.6.
Is there a fix for CVE-2023-4527?
A patch was published on 2023-10-05: Red Hat released security updates for RHEL 8 and 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-4527 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-4527?
Check whether you run Gnu Glibc, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw was found in the glibc getaddrinfo function when called with the AF_UNSPEC address family on systems configured with 'no-aaaa' mode in /etc/resolv.conf. When these conditions are met, a DNS response received via TCP that exceeds 2048 bytes can trigger an out-of-bounds read on the stack. An attacker capable of providing large DNS responses can exploit this to disclose stack contents through the returned address data or cause the application to crash (Denial of Service). The vulnerability is classified as a stack-based buffer overflow/read overflow. Patches have been released by GNU and various Linux distributions including Red Hat and Fedora.

Affected products

  • GNU glibc up to (excluding) 2.39, 2.36 up to (excluding) 2.36.113, 2.37 up to (excluding) 2.37.38, 2.38 up to (excluding) 2.38.19
  • Red Hat Enterprise Linux 8 2.28-225.el8_8.6
  • Red Hat Enterprise Linux 9 9.2, 9.4, 9.6

Timeline

  • 2023-09-18: advisory: Initial NVD publication
  • 2023-10-05: patched: Red Hat released security updates for RHEL 8 and 9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.