Vulnerability Advisories
Unprivileged attackers can get root access on multiple major Linux distributions in default configurations by exploiting a newly disclosed local privilege escalation (LPE) vulnerability in the GNU C Library (glibc).
Tracked as CVE-2023-6246, this security flaw was found in glibc’s __vsyslog_internal() function, called by the widely-used syslog and vsyslog functions for writing messages to the system message logger.
The bug is due to a heap-based buffer overflow weakness accidentally introduced in glibc 2.37 in August 2022 and later backported to glibc 2.36 when addressing a less severe vulnerability tracked as CVE-2022-39046.
Impacted products and versions:
• Debian 12 and 13
• Ubuntu 23.04 and 23.10
• Fedora 37 to 39.
CVE-2023-6246 glibc vsyslog Vulnerability Awareness Advisory.pdf (145 KB)