Junglewise Threat Intelligence

CVE-2023-6779: GNU glibc heap buffer overflow in __vsyslog_internal

CVE-2023-6779 · Severity: high · CVSS 8.2 · Published 2024-01-31

Technologies: Gnu Glibc. Vendors: Gnu.

Executive brief

A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems to perform basic tasks like logging and memory management. An attacker can exploit this flaw to crash applications or potentially gain full administrative (root) control over a system. This issue is particularly serious because it can be triggered through common system utilities like 'su', allowing a standard user to bypass security restrictions.

Technical details

An off-by-one heap-based buffer overflow exists in the __vsyslog_internal function of glibc, which is utilized by the syslog() and vsyslog() functions. The vulnerability is triggered when these functions are called with a message exceeding INT_MAX bytes, or when an attacker-controlled program name (argv[0]) exceeds 1024 bytes, leading to an incorrect buffer size calculation. While the NVD lists a network attack vector, security researchers note that it is primarily exploitable locally. Successful exploitation can lead to a heap overflow, which researchers have demonstrated can be used to achieve Local Privilege Escalation (LPE) to root on distributions like Fedora 38. The issue was introduced in glibc 2.37 and is fixed in version 2.39.

Affected products

  • GNU glibc 2.37, 2.38

Timeline

  • 2023-12-13: disclosed: Reported to Red Hat Bugzilla
  • 2024-01-30: advisory: Qualys security advisory published
  • 2024-01-31: patched: Fedora 39 update released

References

Related threats