Junglewise Threat Intelligence

CVE-2023-6780: GNU glibc integer overflow in __vsyslog_internal

CVE-2023-6780 · Severity: medium · CVSS 5.3 · Published 2024-01-31

Technologies: Gnu Glibc. Vendors: Gnu.

Executive brief

A vulnerability exists in the standard GNU C Library (glibc), a fundamental component used by almost all Linux-based systems. An attacker can exploit this flaw by providing an extremely long program name or message to the system's logging functions. This can lead to a system crash or, in some cases, allow a local user to gain full administrative (root) privileges on the machine.

Technical details

An integer overflow vulnerability exists in the __vsyslog_internal function within glibc, which is internally called by syslog() and vsyslog(). The flaw occurs when the function calculates the buffer size required for a log message; if the message (specifically the program name/argv[0]) is sufficiently large (e.g., >1024 bytes), the size calculation overflows, leading to a 1-byte heap allocation that is subsequently overflowed with attacker-controlled data. While the CVSS vector suggests network reachability, security researchers have demonstrated that it is primarily a local privilege escalation (LPE) vector, successfully exploiting SUID-root binaries like 'su' to gain root access. The issue affects glibc versions 2.37 and 2.38, and was fixed in version 2.39.

Affected products

  • GNU glibc 2.37, 2.38

Timeline

  • 2023-12-13: disclosed: Initial report to Red Hat Bugzilla
  • 2024-01-30: advisory: Qualys security advisory published
  • 2024-01-31: patched: Fedora 39 update released with fix in glibc 2.38-16

References

Related threats