CVE-2023-4813
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.
- Affected products
- Almalinux, Astra Linux, Centos, Debian, Linuxmint, Red Hat, Rocky Linux, Suse
- Gnu Glibc
- < 2.36
- CVSS 3.1
- 5.9 MEDIUM
- EPSS
- 1.7% (75th percentile)
- Weakness
- CWE-416
- NVD status
- Modified
- Published
- 2023-09-12
Workaround
Removing the "SUCCESS=continue" or "SUCCESS=merge" configuration from the hosts database in /etc/nsswitch.conf will mitigate this vulnerability. Note that, these options are not supported by the hosts database, if they were working before it was because of this bug.
CVE-2023-4813 at NVD
1 known exploit for CVE-2023-4813
Proof-of-concept code and exploit modules indexed by Sploitus