PT-2023-8453 · Glibc+8 · Glibc+8

Guilherme De Almeida Suckevicz + 1 · Published 2023-09-12 · Updated 2026-05-12 · CVE-2023-4806

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions glibc (affected versions not specified)

Description A flaw was found in glibc, where the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss * gethostbyname2 r and nss * getcanonname r hooks without implementing the nss * gethostbyname3 r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF INET6 address family with AI CANONNAME, AI ALL, and AI V4MAPPED as flags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2023:5453

ALSA-2023:5455

AZL-29954

AZL-34738

BDU:2024-00852

CESA-2023_5455

CVE-2023-4806

DSA-5514-1

MGASA-2023-0270

OESA-2023-1688

OPENSUSE-SU-2024:13273-1

RHSA-2023:5453

RHSA-2023:5455

RHSA-2023:7409

RHSA-2023_5453

RHSA-2023_5455

RLSA-2023:5455

ROSA-SA-2025-2637

USN-6541-1

USN-6541-2

Affected Products

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Rocky Linux

Ubuntu

Glibc

References · 86

• https://access.redhat.com/errata/RHSA-2023:5455 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7409 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:5453 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-4806 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13273-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6541-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0270.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-4806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5156 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4527 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4806 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34738 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA · Vendor Advisory