Glibc: stack read overflow in getaddrinfo in no-aaaa mode
Priority LOW 32CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01669 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | — | 2.28-225.el8_8.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 2.28-225.el8_8.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.34-60.el9_2.7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.34-60.el9_2.7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-225.el8_8.6 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-225.el8_8.6 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.34-60.el9_2.7 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.34-60.el9_2.7 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | 2.36 to before 2.36.113; 2.37 to before 2.37.38; 2.38 to before 2.38.19 | Vulnerable | GNU |
| cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* | 9.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* | 9.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:* | 9.2_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* | 9.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* | 9.2_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* Versions 2.36 to before 2.36.113; 2.37 to before 2.37.38; 2.38 to before 2.38.19 Vulnerable ·GNU
- cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* Versions 9.2_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* | 9.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:* | 9.2_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* | 8.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:* | 8.8_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_s390x:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* | 8.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:* | 8.8_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* Versions 8.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:* Versions 8.8_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_s390x:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* Versions 8.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:* Versions 8.8_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
Red Hat 2 advisories
- RHSA-2023:5455 Released 2023-10-05 · Red Hat rating Importantglibc security update
- Red Hat Enterprise Linux AppStream (v. 8) compat-libpthread-nonshared-2.28-225.el8_8.6, glibc-utils-2.28-225.el8_8.6
- Red Hat Enterprise Linux BaseOS (v. 8) glibc-2.28-225.el8_8.6, glibc-all-langpacks-2.28-225.el8_8.6, glibc-common-2.28-225.el8_8.6 +47
- Red Hat Enterprise Linux CRB (v. 8) glibc-benchtests-2.28-225.el8_8.6, glibc-nss-devel-2.28-225.el8_8.6, glibc-static-2.28-225.el8_8.6 +1
- RHSA-2023:5453 Released 2023-10-05 · Red Hat rating Importantglibc security update
- Red Hat Enterprise Linux AppStream (v. 9) glibc-devel-2.34-60.el9_2.7, glibc-doc-2.34-60.el9_2.7, glibc-headers-2.34-60.el9_2.7 +2
- Red Hat Enterprise Linux BaseOS (v. 9) glibc-2.34-60.el9_2.7, glibc-all-langpacks-2.34-60.el9_2.7, glibc-common-2.34-60.el9_2.7 +47
- Red Hat Enterprise Linux CRB (v. 9) glibc-benchtests-2.34-60.el9_2.7, glibc-nss-devel-2.34-60.el9_2.7, glibc-static-2.34-60.el9_2.7 +2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 2 more products — RHSA-2023:5453
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-04430 Glibc: potential use-after-free in gaih_inet()Priority LOW 30
- TI-2023-04423 Glibc: potential use-after-free in getaddrinfo()Priority LOW 30
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 2 more products — RHSA-2023:5455
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-04430 Glibc: potential use-after-free in gaih_inet()Priority LOW 30
- TI-2023-04423 Glibc: potential use-after-free in getaddrinfo()Priority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:5455 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:5453 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:5455 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:5453 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:5455 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:5453 |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4527
- 2026-10-03 Alias added: GHSA-hmf7-f8gf-8f4p
References
Exploit 1
Advisory 9
- RHSA-2023:5453
- RHSA-2023:5455
- https://access.redhat.com/security/cve/CVE-2023-4527
- http://www.openwall.com/lists/oss-security/2023/09/25/1
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/
- https://security.gentoo.org/glsa/202310-03
- https://security.netapp.com/advisory/ntap-20231116-0012/
More Red Hat Codeready Linux Builder Eus vulnerabilities
- TI-2019-06284 Memory corruption in webkitgtk KEVCVSS 3.1HIGH 8.8
- TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
- TI-2022-00359 Out-of-bounds write in kernel CVSS 3.1HIGH 8.8
- TI-2023-28739 Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service CVSS 3.1HIGH 7.5
- TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
- TI-2023-05404 Postgresql: buffer overrun from integer overflow in array modification CVSS 3.1HIGH 8.8
Sources
- CVE-2023-4527 · CVE Program
- CVE-2023-4527 · NVD
- FIRST EPSS
- GHSA-hmf7-f8gf-8f4p · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4527 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences