CVE-2023-6246
published 2024-01-31CVE-2023-6246: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions…
PriorityP354high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
4.79%
90.9th percentile
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.36-9+deb12u4 (bookworm) | glibc 2.36-9+deb12u4 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| gnu | glibc | >= 0 < 2.36-9+deb12u4 | 2.36-9+deb12u4 |
| gnu | glibc | >= 0 < 2.37-15 | 2.37-15 |
| gnu | glibc | >= 0 < 2.37-15 | 2.37-15 |
| gnu | glibc | >= 2.36 < 2.39 | 2.39 |
| msrc | azl3_glibc_2.38-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_glibc_2.38-6_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command(exec -a "`printf '%0128000x' 1`" /usr/bin/su < /dev/null)
- →Exploit triggers a segmentation fault (exit code 127) by passing an argv[0] of >1024 bytes to a suid binary that calls syslog/vsyslog without a prior openlog() call; monitor for processes launched with abnormally long process-name arguments (argv[0] > 1024 bytes) ↗
- →PoC uses exec -a with a 128000-character hex string as argv[0] against /usr/bin/su; a segfault exit code of 127 indicates successful overflow trigger
- →Vulnerability was inadvertently introduced in glibc 2.37 (August 2022) and backported to glibc 2.36; flag systems running glibc 2.36 or 2.37 through 2.38 as vulnerable ↗
- →Confirmed vulnerable distributions: Debian 12 and 13, Ubuntu 23.04 and 23.10, Fedora 37 to 39; prioritize patching on these platforms ↗
- ·Exploitation requires specific preconditions: openlog() must not have been called (or called with ident=NULL), and argv[0] must be larger than 1024 bytes; not all syslog-using applications are reachable ↗
- ·This is a local privilege escalation only; remote exploitation is not possible (CVSS AV:L) ↗
- ·Debian bookworm fix is in 2.36-9+deb12u4; forky/sid/trixie fix is in 2.37-15; verify installed glibc package version to confirm patch status ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian8.4HIGH
vendor_redhat8.4HIGH
vendor_msrc7.8HIGH
vendor_oracle7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC S7-1500 CPU Family
cisa_ics·2025-06-12
Siemens SIMATIC S7-1500 CPU Family
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU Family
Release DateJune 12, 2025
Alert CodeICSA-25-162-05
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU family
- Vulnerabilities: Missing Encryption of Sensitive Data, Out-of-bounds Read, Use After Free, Stack-
Oracle
Oracle Oracle Hyperion Risk Matrix: Installation and Configuration (glibc) — CVE-2023-6246
vendor_oracle·2024-04-15·CVSS 7.8
CVE-2023-6246 [HIGH] Oracle Oracle Hyperion Risk Matrix: Installation and Configuration (glibc) — CVE-2023-6246
Oracle Oracle Hyperion Risk Matrix: Installation and Configuration (glibc) vulnerability
CVE: CVE-2023-6246
CVSS: 7.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2024 (APR 2024)
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2024-02-01
CVE-2023-6779 GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: GNU C Library could be made to crash or run programs as an administrator
if it handled a specially crafted request.
It was discovered that the GNU C Library incorrectly handled the syslog()
function call. A local attacker could use this issue to execute arbitrary
code and possibly escalate privileges.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Red Hat
glibc: heap-based buffer overflow in __vsyslog_internal()
vendor_redhat·2024-01-30·CVSS 8.4
CVE-2023-6246 [HIGH] CWE-122 glibc: heap-based buffer overflow in __vsyslog_internal()
glibc: heap-based buffer overflow in __vsyslog_internal()
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basena
Microsoft
Glibc: heap-based buffer overflow in __vsyslog_internal()
vendor_msrc·2024-01-09·CVSS 7.8
CVE-2023-6246 [HIGH] CWE-787 Glibc: heap-based buffer overflow in __vsyslog_internal()
Glibc: heap-based buffer overflow in __vsyslog_internal()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://l
Debian
CVE-2023-6246: glibc - A heap-based buffer overflow was found in the __vsyslog_internal function of the...
vendor_debian·2023·CVSS 8.4
CVE-2023-6246 [HIGH] CVE-2023-6246: glibc - A heap-based buffer overflow was found in the __vsyslog_internal function of the...
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Scope: local
bookworm: resolved (fixed in 2.36-9+deb12u4)
bullseye: resolved
forky: resolved (fixed in 2.37-15)
sid: resolved (fixed in 2.37-15)
trixie: resolved (fixed in 2.37-15)
GHSA
GHSA-p6rw-gvvh-q8v4: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library
ghsa_unreviewed·2024-01-31
CVE-2023-6246 [HIGH] CWE-122 GHSA-p6rw-gvvh-q8v4: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
OSV
CVE-2023-6246: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library
osv·2024-01-31·CVSS 7.8
CVE-2023-6246 [HIGH] CVE-2023-6246: A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
No detection rules found.
Nuclei
glibc's syslog - Local Privilege Escalation
nuclei·CVSS 7.8
CVE-2023-6246 [HIGH] glibc's syslog - Local Privilege Escalation
glibc's syslog - Local Privilege Escalation
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Template:
id: CVE-2023-6246
info:
name: glibc's syslog - Local Privilege Escalation
author: gy741
severity: high
description: |
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when
Qualys
Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog() | Qualys
blogs_qualys·2024-01-30·CVSS 8.4
CVE-2023-6246 [HIGH] Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog() | Qualys
#### Table of Contents
- Vulnerabilities in GNU C Library:
- Heap-Based Buffer Overflow in __vsyslog_internal() Function (CVE-2023-6246):
- Memory Corruption in qsort() Function:
- Qualys QID Coverage:
- Enhance Your Security Posture with Qualys Vulnerability Management, Detection, and Response (VMDR)
- Discover Vulnerable Assets Using Qualys CyberSecurity Asset Management (CSAM)
- Disclosure Timeline for CVE-2023-6246, CVE-2023-6779 and CVE-2023-6780
- Disclosure Timeline for Out-of-bounds read & write in glibcs qsort()
- Technical Details
The Qualys Threat Research Unit (TRU) has recently unearthed four significant vulnerabilities in the GNU C Library, a cornerstone for countless applications in the Linux environment.
Before diving into the specific details of the vulnerabilities disc
Bleepingcomputer
New Linux glibc flaw lets attackers get root on major distros
blogs_bleepingcomputer·2024-01-30·CVSS 8.4
[HIGH] New Linux glibc flaw lets attackers get root on major distros
## New Linux glibc flaw lets attackers get root on major distros
## Sergiu Gatlan
"The buffer overflow issue poses a significant threat as it could allow local privilege escalation, enabling an unprivileged user to gain full root access through crafted inputs to applications that employ these logging functions," Qualys security researchers said.
"Although the vulnerability requires specific conditions to be exploited (such as an unusually long argv[0] or openlog() ident argument), its impact is significant due to the widespread use of the affected library."
## Impacts Debian, Ubuntu, and Fedora systems
While testing their findings, Qualys confirmed that Debian 12 and 13, Ubuntu 23.04 and 23.10, and Fedora 37 to 39 were all vulnerable to CVE-2023-6246 exploits, allowing any unprivilege
Qualys
Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog()
blogs_qualys·2024-01-30·CVSS 8.4
CVE-2023-6246 [HIGH] Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog()
## Table of Contents
Vulnerabilities in GNU C Library:
Heap-Based Buffer Overflow in __vsyslog_internal() Function (CVE-2023-6246):
Memory Corruption in qsort() Function:
Qualys QID Coverage:
Enhance Your Security Posture with Qualys Vulnerability Management, Detection, and Response (VMDR)
Discover Vulnerable Assets Using Qualys CyberSecurity Asset Management (CSAM)
Disclosure Timeline for CVE-2023-6246, CVE-2023-6779 and CVE-2023-6780
Disclosure Timeline for Out-of-bounds read & write in glibcs qsort()
Technical Details
The Qualys Threat Research Unit (TRU) has recently unearthed four significant vulnerabilities in the GNU C Library, a cornerstone for countless applications in the Linux environment.
Before diving into the specific details of the vulnerabilities discovered by th
Bugzilla
CVE-2023-6246 glibc: heap-based buffer overflow in __vsyslog_internal()
bugzilla·2023-11-10·CVSS 7.8
CVE-2023-6246 [HIGH] CVE-2023-6246 glibc: heap-based buffer overflow in __vsyslog_internal()
CVE-2023-6246 glibc: heap-based buffer overflow in __vsyslog_internal()
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Discussion:
Isn't this a duplicate of bug 2123394?
---
Hi @fweimer, it's not the same issue. The comment#0 will be updated to have more details as soon as possible.
---
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 2261987]
http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.htmlhttp://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2024/Feb/3http://seclists.org/fulldisclosure/2024/Feb/5https://access.redhat.com/security/cve/CVE-2023-6246https://bugzilla.redhat.com/show_bug.cgi?id=2249053https://lists.fedoraproject.org/archives/list/[email protected]/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/https://lists.fedoraproject.org/archives/list/[email protected]/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/https://security.gentoo.org/glsa/202402-01https://security.netapp.com/advisory/ntap-20240216-0007/https://www.openwall.com/lists/oss-security/2024/01/30/6https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txthttp://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.htmlhttp://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.htmlhttp://seclists.org/fulldisclosure/2024/Feb/3http://seclists.org/fulldisclosure/2024/Feb/5https://access.redhat.com/security/cve/CVE-2023-6246https://bugzilla.redhat.com/show_bug.cgi?id=2249053https://lists.fedoraproject.org/archives/list/[email protected]/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/https://lists.fedoraproject.org/archives/list/[email protected]/message/MWQ6BZJ6CV5UAW4VZSKJ6TO4KIW2KWAQ/https://security.gentoo.org/glsa/202402-01https://security.netapp.com/advisory/ntap-20240216-0007/https://www.openwall.com/lists/oss-security/2024/01/30/6https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txthttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2024-01-31
Published