CVE-2023-4806

18.09.2023, 17:15

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
redhat	CNA	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 76%

Vendor	Product	Version
gnu	glibc	2.33
redhat	codeready_linux_builder_eus	9.2
redhat	codeready_linux_builder_eus_for_power_little_endian	9.0_ppc64le:_ppc64le
redhat	codeready_linux_builder_eus_for_power_little_endian_eus	9.2_ppc64le:_ppc64le
redhat	codeready_linux_builder_for_arm64	9.0_aarch64:_aarch64
redhat	codeready_linux_builder_for_arm64_eus	9.2_aarch64:_aarch64
redhat	codeready_linux_builder_for_ibm_z_systems	9.0_s390x:_s390x
redhat	codeready_linux_builder_for_ibm_z_systems_eus	9.2_s390x:_s390x
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux_eus	8.8
redhat	enterprise_linux_eus	9.2
redhat	enterprise_linux_for_arm_64	9.0_aarch64:_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.2_aarch64:_aarch64
redhat	enterprise_linux_for_ibm_z_systems	8.0_s390x:_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	8.8_s390x:_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus_s390x	9.2
redhat	enterprise_linux_for_ibm_z_systems_s390x	9.2
redhat	enterprise_linux_for_power_little_endian	8.0_ppc64le:_ppc64le
redhat	enterprise_linux_for_power_little_endian	9.2_ppc64le:_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	8.8_ppc64le:_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	9.2_ppc64le:_ppc64le
redhat	enterprise_linux_server_aus	9.2
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	9.2_ppc64le:_ppc64le
redhat	enterprise_linux_tus	8.8

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

glibc

bullseye	ignored
buster	no-dsa
bullseye (security)	vulnerable
bookworm	2.36-9+deb12u9 fixed
bookworm (security)	2.36-9+deb12u7 fixed
trixie	2.40-4 fixed
sid	2.40-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

eglibc

oracular	dne
noble	dne
mantic	dne
lunar	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

glibc

oracular	Fixed 2.38-1ubuntu5 released
noble	Fixed 2.38-1ubuntu5 released
mantic	Fixed 2.38-1ubuntu5 released
lunar	Fixed 2.37-0ubuntu2.2 released
jammy	Fixed 2.35-0ubuntu3.5 released
focal	Fixed 2.31-0ubuntu9.14 released
bionic	Fixed 2.27-3ubuntu1.6+esm1 released
xenial	Fixed 2.23-0ubuntu11.3+esm5 released
trusty	ignored