Junglewise Threat Intelligence

CVE-2023-4527: GNU glibc stack read overflow in getaddrinfo

CVE-2023-4527 · Severity: medium · CVSS 6.5 · Published 2023-09-18

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Gnu Glibc. Vendors: Red Hat, Gnu.

Executive brief

A security vulnerability has been identified in glibc, a fundamental software library used by almost all Linux-based systems to perform basic operations like looking up website addresses. Under specific configurations, an attacker could send a specially crafted network response that causes a program to crash or potentially leak sensitive internal memory information. This could lead to service outages or provide attackers with data that helps them bypass other security protections.

Technical details

A flaw was found in the glibc getaddrinfo function when called with the AF_UNSPEC address family on systems configured with 'no-aaaa' mode in /etc/resolv.conf. When these conditions are met, a DNS response received via TCP that exceeds 2048 bytes can trigger an out-of-bounds read on the stack. An attacker capable of providing large DNS responses can exploit this to disclose stack contents through the returned address data or cause the application to crash (Denial of Service). The vulnerability is classified as a stack-based buffer overflow/read overflow. Patches have been released by GNU and various Linux distributions including Red Hat and Fedora.

Affected products

  • GNU glibc up to (excluding) 2.39, 2.36 up to (excluding) 2.36.113, 2.37 up to (excluding) 2.37.38, 2.38 up to (excluding) 2.38.19
  • Red Hat Enterprise Linux 8 2.28-225.el8_8.6
  • Red Hat Enterprise Linux 9 9.2, 9.4, 9.6

Timeline

  • 2023-09-18: advisory: Initial NVD publication
  • 2023-10-05: patched: Red Hat released security updates for RHEL 8 and 9

References

Related threats