CVE-2023-6246: fedoraproject fedora Out-of-bounds Write

Vulnerability summary

CVE-2023-6246 is a high (CVSS 8.4) Out-of-bounds Write vulnerability in fedoraproject fedora. EPSS estimates a 4.79% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities. 6 public exploits are recorded.

Timeline

1. 31-01-2024
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().