PT-2023-8453 · Glibc+8 · Glibc+8

Guilherme De Almeida Suckevicz + 1 · Publicado 2023-09-12 · Atualizado 2026-05-12 · CVE-2023-4806

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions glibc (affected versions not specified)

Description A flaw was found in glibc, where the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss * gethostbyname2 r and nss * getcanonname r hooks without implementing the nss * gethostbyname3 r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF INET6 address family with AI CANONNAME, AI ALL, and AI V4MAPPED as flags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALSA-2023:5453

ALSA-2023:5455

AZL-29954

AZL-34738

BDU:2024-00852

CESA-2023_5455

CVE-2023-4806

DSA-5514-1

MGASA-2023-0270

OESA-2023-1688

OPENSUSE-SU-2024:13273-1

RHSA-2023:5453

RHSA-2023:5455

RHSA-2023:7409

RHSA-2023_5453

RHSA-2023_5455

RLSA-2023:5455

ROSA-SA-2025-2637

USN-6541-1

USN-6541-2

Produtos afetados

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Rocky Linux

Ubuntu

Glibc

Referências · 86

• https://twitter.com/Esparta6108713/status/1750525837957636276 · Publicação no Twitter
• https://access.redhat.com/errata/RHSA-2023:5455 · Aviso do Fabricante
• https://docs.bell-sw.com/security/advisories/BELL-SA-2023-2 · Nota
• https://access.redhat.com/errata/RHSA-2023:7409 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2237782 · Nota
• https://access.redhat.com/security/cve/CVE-2023-4911 · Nota
• http://openwall.com/lists/oss-security/2023/10/03/6 · Nota
• https://twitter.com/shah_sheikh/status/1745211818447098295 · Publicação no Twitter
• https://bugs.mageia.org/show_bug.cgi?id=32292 · Nota
• https://suse.com/security/cve/CVE-2023-4806 · Nota
• https://access.redhat.com/errata/RHSA-2023:5453 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-4806 · Nota
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-4806 · Aviso do Fabricante