VDB
DEBIAN-CVE-2023-6246
DEBIAN-CVE-2023-6246
PUBLISHED
CVSS 7.800000190734863 HIGH
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | glibc | 2.36-9+deb12u2, 2.36-9+deb12u3, * |
| Debian:14 | glibc | 0, 0, 0 |
| Debian:13 | glibc | 0, 0, 0 |
Exploit Intelligence
- elpe-pinillo/CVE-2023-6246 (github-poc-repo)
- CVE-2023-6246 glibc __vsyslog_internal() heap buffer overflow exploitation using Convergent Time Theory (α = 0.0302011). 33-layer temporal heap spray + phase-locked trigger for reliable local privilege escalation. (github-poc-repo)
- CVE-2023-6246 glibc __vsyslog_internal() heap buffer overflow exploitation using Convergent Time Theory (α = 0.0302011). 33-layer temporal heap spray + phase-locked trigger for reliable local privilege escalation. (github-poc)
- elpe-pinillo/CVE-2023-6246 (github-poc)
- DemoReseedInfra.kt (github-poc)
Timeline
- Jan 31, 2024 CVE Published
- Apr 28, 2026 CVE Updated