Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-6246
HistoryJan 31, 2024 - 12:00 a.m.

CVE-2023-6246

2024-01-3100:00:00
ubuntu.com
ubuntu.com
28
heap-based buffer overflow
glibc library
local privilege escalation
syslog function
openlog function

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.3%

A heap-based buffer overflow was found in the __vsyslog_internal function
of the glibc library. This function is called by the syslog and vsyslog
functions. This issue occurs when the openlog function was not called, or
called with the ident argument set to NULL, and the program name (the
basename of argv[0]) is bigger than 1024 bytes, resulting in an application
crash or local privilege escalation. This issue affects glibc 2.36 and
newer.

Notes

Author Note
mdeslaur introduced by: https://sourceware.org/git/?p=glibc.git;a=commit;h=52a5be0df411ef3ff45c10c7c308cb92993d15b1 in glibc 3.36
OSVersionArchitecturePackageVersionFilename
ubuntu23.10noarchglibc<Β 2.38-1ubuntu6.1UNKNOWN
ubuntu24.04noarchglibc<Β 2.39-0ubuntu1UNKNOWN

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.3%