CVE-2023-24809 NetHack Call command buffer overflow

What is CVE-2023-24809?

CVE-2023-24809 is a medium-severity memory corruption vulnerability in NetHack, published on 17 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Weakness: CWE-120

Which versions are affected by CVE-2023-24809?

It affects 1 product.

Products include Nethack Nethack.

How do I fix CVE-2023-24809?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-24809 being exploited?

There is no known exploitation of CVE-2023-24809 in the wild and no public exploit code.

Other vulnerabilities in NetHack

• CVE-2019-19905 Memory corruption in n/a Critical 9.8
• CVE-2020-5209 NetHack command line parsing of options starting with -de and -i is subject to a buffer overflow Medium 5.0
• CVE-2020-5210 NetHack command line -w option parsing is subject to a buffer overflow Medium 5.0
• CVE-2020-5211 NetHack AUTOCOMPLETE configuration file option is subject to a buffer overflow Medium 5.0
• CVE-2020-5212 NetHack MENUCOLOR configuration file option is subject to a buffer overflow Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-24809, GHSA-2cqv-5w4v-mgch, UBUNTU-CVE-2023-24809.