CVE-2023-4813

Description

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Affected (18)

Products: Gnu: Glibc · Redhat: Enterprise Linux, Enterprise Linux Eus, Enterprise Linux For Ibm Z Systems Eus S390x, Enterprise Linux For Ibm Z Systems S390x, Enterprise Linux For Power Little Endian, Enterprise Linux For Power Little Endian Eus, Enterprise Linux Server Aus, Enterprise Linux Server Tus · Fedoraproject: Fedora · +1 more

Show all products

1 product

8 products

Enterprise Linux For Ibm Z Systems Eus S390x

Enterprise Linux For Ibm Z Systems S390x

Enterprise Linux For Power Little Endian

Enterprise Linux For Power Little Endian Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Fedoraproject

1 product

Fedora

Netapp

6 products

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	Before 2.36

Configuration B

10 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Enterprise Linux Eus	Version 8.8
Redhat Enterprise Linux Eus	Version 9.2
Redhat Enterprise Linux For Ibm Z Systems Eus S390x	Version 9.2
Redhat Enterprise Linux For Ibm Z Systems S390x	Version 9.2
Redhat Enterprise Linux For Power Little Endian	Version 9.2_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 9.2_ppc64le
Redhat Enterprise Linux Server Aus	Version 9.2
Redhat Enterprise Linux Server Tus	Version 8.8

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 38

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (13)

https://access.redhat.com/errata/RHBA-2024:2413

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2023:5453

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:5455

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:7409

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2023-4813

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2237798

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/03/8