CVE-2023-4806
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
A use-after-free flaw has been found in glibc's getaddrinfo function. In an extremely rare scenario where an NSS module implements only specific hooks and the query meets certain conditions, an application crash may occur.
Risk Assessment
The risk for the organization is a potential crash of applications performing DNS resolution under specific, rare configurations. This could lead to service disruptions.
Recommendation
It is recommended to update glibc to a patched version (e.g., 2.38 or later). As a workaround, avoid using AI_ALL and AI_V4MAPPED flags in getaddrinfo calls.
Other vulnerabilities in glibc
See all- CVE-2023-6779High
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This issue occurs when the syslog and vsyslog functions are called with a message larger than INT_MAX bytes, leading to an incorrect buffer size calculation and application crash.
- CVE-2015-5180High
The res_query function in libresolv in glibc before version 2.25 has a vulnerability that allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to process crashes.
- CVE-2017-1000366High
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, potentially resulting in arbitrary code execution. This affects glibc 2.25 and earlier.
- CVE-2015-5229High
The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
- CVE-2016-2856High
In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.
- CVE-2015-0235High
CVE-2015-0235 involves a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc in versions 2.2 and other 2.x versions before 2.18. This allows attackers to execute arbitrary code via the gethostbyname or gethostbyname2 functions.
- CVE-2014-4043High
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, allowing context-dependent attackers to trigger use-after-free vulnerabilities.
- CVE-2023-4813Medium
A flaw in glibc may cause the gaih_inet function to use freed memory in uncommon situations, leading to an application crash. This issue is only exploitable when getaddrinfo is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=.
- CVE-2020-1751High
An out-of-bounds write vulnerability was found in glibc before version 2.31 when handling signal trampolines on PowerPC. The backtrace function did not properly check array bounds when storing the frame address, leading to denial of service or potential code execution.
- CVE-2024-33600Medium
In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.
Original NVD description (English source)
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS