CVE-2023-6779: fedoraproject fedora Out-of-bounds Write

Vulnerability summary

CVE-2023-6779 is a high (CVSS 8.2) Out-of-bounds Write vulnerability in fedoraproject fedora. EPSS estimates a 3.15% chance of exploitation in the next 30 days, higher than 87.7% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 31-01-2024
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().