Is CVE-2023-6780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-6780 being exploited in the wild.

How severe is CVE-2023-6780?

Medium severity, with a CVSS score of 5.3, published 31 January 2024.

Is there a fix for CVE-2023-6780?

A patch was published on 2024-01-31: Fedora 39 update released with fix in glibc 2.38-16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-6780 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2023-6780?

Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-6780: GNU glibc integer overflow in __vsyslog_internal

CVE-2023-6780 · Severity: medium · CVSS 5.3 · Published 2024-01-31

A vulnerability exists in the standard GNU C Library (glibc), a fundamental component used by almost all Linux-based systems. An attacker can exploit this flaw by providing an extremely long program name or message to the system's logging functions. This can lead to a system crash or, in some cases, allow a local user to gain full administrative (root) privileges on the machine.

Technologies: Gnu Glibc. Vendors: Gnu.

Quick answers

Is CVE-2023-6780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-6780 being exploited in the wild.
How severe is CVE-2023-6780?: Medium severity, with a CVSS score of 5.3, published 31 January 2024.
Which products and versions are affected?: Gnu Glibc 2.37, 2.38.
Is there a fix for CVE-2023-6780?: A patch was published on 2024-01-31: Fedora 39 update released with fix in glibc 2.38-16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-6780 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2023-6780?: Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the __vsyslog_internal function within glibc, which is internally called by syslog() and vsyslog(). The flaw occurs when the function calculates the buffer size required for a log message; if the message (specifically the program name/argv[0]) is sufficiently large (e.g., >1024 bytes), the size calculation overflows, leading to a 1-byte heap allocation that is subsequently overflowed with attacker-controlled data. While the CVSS vector suggests network reachability, security researchers have demonstrated that it is primarily a local privilege escalation (LPE) vector, successfully exploiting SUID-root binaries like 'su' to gain root access. The issue affects glibc versions 2.37 and 2.38, and was fixed in version 2.39.

Affected products

GNU glibc 2.37, 2.38

Timeline

2023-12-13: disclosed: Initial report to Red Hat Bugzilla
2024-01-30: advisory: Qualys security advisory published
2024-01-31: patched: Fedora 39 update released with fix in glibc 2.38-16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.