CVE-2023-6779: GNU glibc heap buffer overflow in __vsyslog_internal

CVE-2023-6779 · Severity: high · CVSS 8.2 · Published 2024-01-31

A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems to perform basic tasks like logging and memory management. An attacker can exploit this flaw to crash applications or potentially gain full administrative (root) control over a system. This issue is particularly serious because it can be triggered through common system utilities like 'su', allowing a standard user to bypass security restrictions.

Technologies: Gnu Glibc. Vendors: Gnu.

Quick answers

Is CVE-2023-6779 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-6779 being exploited in the wild.
How severe is CVE-2023-6779?
High severity, with a CVSS score of 8.2, published 31 January 2024.
Which products and versions are affected?
Gnu Glibc 2.37, 2.38.
Is there a fix for CVE-2023-6779?
A patch was published on 2024-01-31: Fedora 39 update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-6779 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2023-6779?
Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An off-by-one heap-based buffer overflow exists in the __vsyslog_internal function of glibc, which is utilized by the syslog() and vsyslog() functions. The vulnerability is triggered when these functions are called with a message exceeding INT_MAX bytes, or when an attacker-controlled program name (argv[0]) exceeds 1024 bytes, leading to an incorrect buffer size calculation. While the NVD lists a network attack vector, security researchers note that it is primarily exploitable locally. Successful exploitation can lead to a heap overflow, which researchers have demonstrated can be used to achieve Local Privilege Escalation (LPE) to root on distributions like Fedora 38. The issue was introduced in glibc 2.37 and is fixed in version 2.39.

Affected products

  • GNU glibc 2.37, 2.38

Timeline

  • 2023-12-13: disclosed: Reported to Red Hat Bugzilla
  • 2024-01-30: advisory: Qualys security advisory published
  • 2024-01-31: patched: Fedora 39 update released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.