PT-2024-1402 · Glibc+2 · Glibc+2
Pedro Sampaio
·
Published
2024-01-15
·
Updated
2026-03-10
·
CVE-2023-6246
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
glibc versions 2.36 and newer
Description
A heap-based buffer overflow was found in the vsyslog internal function of the glibc library. This function is called by the syslog and vsyslog functions. The issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This vulnerability allows attackers to elevate their privileges on Linux systems to root level.
Recommendations
For glibc versions 2.36 and newer, update to a patched version of glibc to resolve the issue. If a patched version is not available, consider disabling the vulnerable function vsyslog internal() as a temporary workaround. Restrict access to the syslog and vsyslog functions to minimize the risk of exploitation. Avoid using the ident argument set to NULL in the openlog function.
Exploit
Fix
LPE
Integer Overflow
Buffer Overflow
Memory Corruption
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ubuntu
Glibc