High severity · published Jan 31, 2024
CVE-2023-6246
Glibc: heap-based buffer overflow in __vsyslog_internal()
7.8
CVSS
4.8%
EPSS
No
On KEV
Description
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
38; 39 · source: vendor, NVD
GL
Glibc · Gnu
2.36 before 2.39 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5; V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.5; V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6246
Exploit
http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html
Exploit
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
Exploit
http://seclists.org/fulldisclosure/2024/Feb/3
Exploit
http://seclists.org/fulldisclosure/2024/Feb/5
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-6246
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2249053
More from Fedora
8.8
CVE-2026-94422
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
7.8
CVE-2026-19624
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
7.5
CVE-2023-6779
Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
7.1
CVE-2026-19816
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
6.5
CVE-2023-3338
Crash due to a null pointer dereference in the dn_nsp_send function