CVE-2023-4156 Heap out of bound read in builtin.c

Medium 4.4 Published 25 Sep 2023 Updated 24 Sep 2024

A heap out-of-bounds read in gawk allows attackers to read sensitive information or cause a crash.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-4156?

CVE-2023-4156 is a medium-severity vulnerability in Fedoraproject Fedora, published on 25 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.

Weakness: CWE-125

Which versions are affected by CVE-2023-4156?

It affects 3 products.

Linux distribution packages (14)

`gawk` SUSE:Linux Enterprise Micro 5.1	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Linux Enterprise Micro 5.2	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Linux Enterprise Micro 5.3	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Linux Enterprise Micro 5.4	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Linux Enterprise Server 12 SP5	All versions	`4.1.0-5.3.1`
`gawk` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`4.1.0-5.3.1`
`gawk` SUSE:Manager Proxy 4.2	All versions	`4.2.1-150000.3.3.1`
`gawk` SUSE:Manager Server 4.2	All versions	`4.2.1-150000.3.3.1`
`gawk` openSUSE:Leap 15.4	All versions	`4.2.1-150000.3.3.1`
`gawk` openSUSE:Leap 15.5	All versions	`4.2.1-150000.3.3.1`
`gawk` openSUSE:Leap Micro 5.3	All versions	`4.2.1-150000.3.3.1`
`gawk` openSUSE:Leap Micro 5.4	All versions	`4.2.1-150000.3.3.1`

Products include Fedoraproject Fedora, Gnu Gawk, Redhat Enterprise Linux.

How do I fix CVE-2023-4156?

Apply the vendor's patch.

Is CVE-2023-4156 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4156 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as AZL-30045, CLSA-2024-1712176685, CLSA-2025-1751619853, CLSA-2026-1777030298, CLSA-2026-1777888717, DEBIAN-CVE-2023-4156 and 6 more.