CVE-2023-4806

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.(CVE-2023-4806)

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.(CVE-2023-4813)

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.(CVE-2023-5156)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)

• glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)

• glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806)

• glibc: potential use-after-free in gaih_inet() (CVE-2023-4813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2023-4806 in the glibc package for Root:Debian:11. Multiple fixed versions available.

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)
• glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)
• glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806)
• glibc: potential use-after-free in gaih_inet() (CVE-2023-4813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)
• glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527)
• glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806)
• glibc: potential use-after-free in gaih_inet() (CVE-2023-4813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: A flaw fixed when the getaddrinfo function may access memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4806.patch: fix the flaw
  • CVE-2023-4806
• SECURITY UPDATE: In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4813.patch: fix the flaw
  • CVE-2023-4813

• SECURITY UPDATE: A flaw fixed when the getaddrinfo function may access memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4806.patch: fix the flaw
  • CVE-2023-4806
• SECURITY UPDATE: In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash
  • debian/patches/any/CVE-2023-4813.patch: fix the flaw
  • CVE-2023-4813

• Fix a memory leak in convert_hostent_to_gaih_addrtuple function with AI_ALL
• CVE-2023-4806: fix memory access issue in getaddrinfo function by implementing nss*_gethostbyname3_r hook
• CVE-2023-4813: fix memory leakage in gaih_inet function to prevent application crash when getaddrinfo function is called with specified hosts database configurations in /etc/nsswitch.conf

• Fix a memory leak in convert_hostent_to_gaih_addrtuple function with AI_ALL
• CVE-2023-4806: fix memory access issue in getaddrinfo function by implementing nss*_gethostbyname3_r hook
• CVE-2023-4813: fix memory leakage in gaih_inet function to prevent application crash when getaddrinfo function is called with specified hosts database configurations in /etc/nsswitch.conf

getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)

Stack read overflow with large TCP responses in no-aaaa mode (CVE-2023-4527)

elf: Introduce to _dl_call_fini elf: Do not run constructors for proxy objects elf: Always call destructors in reverse constructor order [BZ #30785] elf: Remove unused l_text_end field from struct link_map elf: Move l_init_called_next to old place of l_text_end in link map elf: Fix slow tls access after dlopen [BZ #19924] intl: Treat C.UTF-8 locale like C locale [BZ# 16621] x86: Increase non_temporal_threshold to roughly "sizeof_L3 / 4" x86: Fix slight bug in shared_per_thread cache size calculation x86: Use 3/4*sizeof(per-thread-L3) as low bound for NT threshold x86: Fix incorrect scope of setting shared_per_thread [BZ #30745]

These are all security issues fixed in the glibc-2.38-3.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that the GNU C Library was not properly handling certain memory operations. An attacker could possibly use this issue to cause a denial of service (application crash). (CVE-2023-4806, CVE-2023-4813)

It was discovered that the GNU C library was not properly implementing a fix for CVE-2023-4806 in certain cases, which could lead to a memory leak. An attacker could possibly use this issue to cause a denial of service (application crash). This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-5156)