CVE Vulnerabilities

CVE-2023-4813

Use After Free

Published: Sep 12, 2023 | Modified: Apr 30, 2025
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
5.9 MODERATE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Glibc Gnu * 2.36 (excluding)
Red Hat Enterprise Linux 8 RedHat glibc-0:2.28-225.el8_8.6 *
Red Hat Enterprise Linux 8 RedHat glibc-0:2.28-225.el8_8.6 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat glibc-0:2.28-189.8.el8_6 *
Red Hat Enterprise Linux 9 RedHat glibc-0:2.34-100.el9 *
Red Hat Enterprise Linux 9 RedHat glibc-0:2.34-60.el9_2.7 *
Red Hat Enterprise Linux 9 RedHat glibc-0:2.34-100.el9 *
Red Hat Enterprise Linux 9 RedHat glibc-0:2.34-60.el9_2.7 *
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 RedHat glibc-0:2.28-189.8.el8_6 *
Eglibc Ubuntu trusty *
Eglibc Ubuntu trusty/esm *
Glibc Ubuntu bionic *
Glibc Ubuntu esm-infra/bionic *
Glibc Ubuntu esm-infra/focal *
Glibc Ubuntu esm-infra/xenial *
Glibc Ubuntu focal *
Glibc Ubuntu jammy *
Glibc Ubuntu trusty *
Glibc Ubuntu upstream *
Glibc Ubuntu xenial *

Potential Mitigations

References