CVE-2023-4806 Glibc: potential use-after-free in getaddrinfo()
A rare use-after-free in glibc's getaddrinfo can cause application crashes when specific NSS modules and flags are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4806?
CVE-2023-4806 is a medium-severity use after free vulnerability in Fedoraproject Fedora, published on 18 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.
Weakness: CWE-416
Which versions are affected by CVE-2023-4806?
It affects 22 products.
Products include Fedoraproject Fedora, Gnu Glibc, Redhat Codeready Linux Builder Eus, Redhat Codeready Linux Builder Eus for Power Little Endian, Redhat Codeready Linux Builder Eus for Power Little Endian Eus, Redhat Codeready Linux Builder for Arm64 and 16 more.
How do I fix CVE-2023-4806?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-4806 being exploited?
There is no known exploitation of CVE-2023-4806 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-29954, AZL-34738, BELL-CVE-2023-4806, DEBIAN-CVE-2023-4806, GHSA-5f52-v49r-796w, ROOT-OS-DEBIAN-11-CVE-2023-4806.