CVE-2023-4813

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.(CVE-2023-4806)

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.(CVE-2023-4813)

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.(CVE-2023-5156)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)

• glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)

• glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806)

• glibc: potential use-after-free in gaih_inet() (CVE-2023-4813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2023-4813 in the glibc package for Root:Debian:11. Multiple fixed versions available.

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)
• glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)
• glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806)
• glibc: potential use-after-free in gaih_inet() (CVE-2023-4813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)
• glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)
• glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806)
• glibc: potential use-after-free in gaih_inet() (CVE-2023-4813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: A flaw fixed when the getaddrinfo function may access memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4806.patch: fix the flaw
  • CVE-2023-4806
• SECURITY UPDATE: In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4813.patch: fix the flaw
  • CVE-2023-4813

• SECURITY UPDATE: A flaw fixed when the getaddrinfo function may access memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4806.patch: fix the flaw
  • CVE-2023-4806
• SECURITY UPDATE: In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4813.patch: fix the flaw
  • CVE-2023-4813

• Fix a memory leak in convert_hostent_to_gaih_addrtuple function with AI_ALL
• CVE-2023-4806: fix memory access issue in getaddrinfo function by implementing nss*_gethostbyname3_r hook
• CVE-2023-4813: fix memory leakage in gaih_inet function to prevent application crash when getaddrinfo function is called with specified hosts database configurations in /etc/nsswitch.conf

• Fix a memory leak in convert_hostent_to_gaih_addrtuple function with AI_ALL
• CVE-2023-4806: fix memory access issue in getaddrinfo function by implementing nss*_gethostbyname3_r hook
• CVE-2023-4813: fix memory leakage in gaih_inet function to prevent application crash when getaddrinfo function is called with specified hosts database configurations in /etc/nsswitch.conf

These are all security issues fixed in the glibc-2.38-6.1 package on the GA media of openSUSE Tumbleweed.

This update of glibc fixes the following issues:

Security issue fixed:

• CVE-2023-4813: Fixed a potential use-after-free in gaih_inet() (bsc#1215286, BZ #28931)

Other issues fixed:

• S390: Fix relocation of _nl_current_LC_CATETORY_used in static build (bsc#1215504, BZ #19860)
• added GB18030-2022 charmap (jsc#PED-4908, BZ #30243)

This update for glibc fixes the following issues:

Security issue fixed:

• CVE-2023-4813: Fixed a potential use-after-free in gaih_inet() (bsc#1215286, BZ #28931)

Other changes:

• Added GB18030-2022 charmap (jsc#PED-4908, BZ #30243)
• Run vismain only if linker supports protected data symbol (bsc#1215505)

This update for glibc fixes the following issues:

Security issue fixed:

• CVE-2023-4813: Fixed a potential use-after-free in gaih_inet() (bsc#1215286, BZ #28931)

Also a regression from a previous update was fixed:

• elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676)

It was discovered that the GNU C Library was not properly handling certain memory operations. An attacker could possibly use this issue to cause a denial of service (application crash). (CVE-2023-4806, CVE-2023-4813)

It was discovered that the GNU C library was not properly implementing a fix for CVE-2023-4806 in certain cases, which could lead to a memory leak. An attacker could possibly use this issue to cause a denial of service (application crash). This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-5156)