CVE-2023-6246
HIGHCVSS v3
7.8
HIGH
EPSS Score
24.3%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Technical Details
- Published
- 1/31/2024
Frequently Asked Questions
What is CVE-2023-6246?
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Is CVE-2023-6246 actively exploited?
Active exploitation of CVE-2023-6246 has not been confirmed. The EPSS score is 24.3%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2023-6246?
CVE-2023-6246 has a CVSS v3 base score of 7.8 (HIGH severity).
Is CVE-2023-6246 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.