Description
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- fedoraproject / fedora38 – 38
- gnu / glibc2.36
- NetApp / active_iq_unified_manager
- NetApp / h300s_firmware
- NetApp / h410c_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h700s_firmware
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux_eus9.2 – 9.2
- RedHat / enterprise_linux_eus8.8 – 8.8
- RedHat / enterprise_linux_for_ibm_z_systems_eus_s390x9.2 – 9.2
- RedHat / enterprise_linux_for_ibm_z_systems_s390x9.2 – 9.2
- RedHat / enterprise_linux_for_power_little_endian9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_server_aus9.2 – 9.2
- RedHat / enterprise_linux_server_tus8.8 – 8.8
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHBA-2024:2413
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:5453
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:5455
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:7409
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2023-4813
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2237798
Updated 44m ago · 8 sources