Is CVE-2023-6246 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-6246 being exploited in the wild.

How severe is CVE-2023-6246?

High severity, with a CVSS score of 8.4, published 31 January 2024.

Is there a fix for CVE-2023-6246?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-6246 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2023-6246?

Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-6246: GNU glibc heap buffer overflow in __vsyslog_internal

CVE-2023-6246 · Severity: high · CVSS 8.4 · Published 2024-01-31

A vulnerability exists in the GNU C Library (glibc), a fundamental component of Linux systems used by almost all applications for basic tasks like logging. By manipulating how a program starts, a local attacker can cause a memory error that allows them to crash applications or gain full administrative (root) privileges on the system. This poses a significant risk to multi-user environments and servers where unprivileged users might attempt to escalate their access.

Technologies: Gnu Glibc. Vendors: Gnu.

Quick answers

Is CVE-2023-6246 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-6246 being exploited in the wild.
How severe is CVE-2023-6246?: High severity, with a CVSS score of 8.4, published 31 January 2024.
Which products and versions are affected?: Gnu Glibc 2.36 and newer.
Is there a fix for CVE-2023-6246?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-6246 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2023-6246?: Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the __vsyslog_internal function within glibc, which is internally called by syslog() and vsyslog(). The vulnerability is triggered when openlog() is not called (or called with a NULL ident) and the program name (argv[0]) exceeds 1024 bytes. In this state, the function fails to correctly calculate the required buffer size, resulting in a 1-byte malloc() that is subsequently overflowed by the attacker-controlled program name and message content. This can be exploited via SUID-root binaries like 'su' that use PAM (which calls syslog on authentication failure) to achieve local privilege escalation to root. The issue affects glibc versions 2.36 and newer.

Affected products

GNU glibc 2.36 and newer

Timeline

2022-08-01: other: Vulnerability introduced in glibc 2.37 and backported to 2.36
2024-01-30: disclosed: Advisory published by Qualys
2024-01-31: advisory: CVE-2023-6246 assigned and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.