Read the docs
TI-2023-04423 Aliases CVE-2023-4806GHSA-5f52-v49r-796w

Glibc: potential use-after-free in getaddrinfo()

Priority LOW 30CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01606 76th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 10 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 8—2.28-225.el8_8.6Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.28-225.el8_8.6Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—2.28-189.8.el8_6Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.34-60.el9_2.7Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.34-60.el9_2.7Patch availableCNA
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8—2.28-189.8.el8_6Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-225.el8_8.6 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-225.el8_8.6 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.28-189.8.el8_6 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.34-60.el9_2.7 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.34-60.el9_2.7 Patch available CNA
  • Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-189.8.el8_6 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:gnu:glibc:2.33:*:*:*:*:*:*:*2.33VulnerableGNU
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*9.0_ppc64leVulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*9.2_ppc64leVulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*9.0_aarch64VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*9.2_aarch64VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*9.0_s390xVulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*9.2_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:a:gnu:glibc:2.33:*:*:*:*:*:*:* Versions 2.33 Vulnerable ·GNU
  • cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* Versions 9.2_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*9.0_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:*9.2_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*8.0_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*8.8_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_s390x:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*8.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:*9.2_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*8.8_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*9.2_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*9.2_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* Versions 8.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:* Versions 8.8_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_s390x:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* Versions 8.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:* Versions 8.8_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject

Remediation

Red Hat 3 advisories

  • RHSA-2023:7409 Released 2023-11-21 · Red Hat rating Moderate
    glibc security update
    • Red Hat CodeReady Linux Builder EUS (v.8.6) glibc-benchtests-2.28-189.8.el8_6, glibc-nss-devel-2.28-189.8.el8_6, glibc-static-2.28-189.8.el8_6 +1
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) compat-libpthread-nonshared-2.28-189.8.el8_6, glibc-utils-2.28-189.8.el8_6
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) glibc-2.28-189.8.el8_6, glibc-all-langpacks-2.28-189.8.el8_6, glibc-common-2.28-189.8.el8_6 +47
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 glibc-devel-2.28-189.8.el8_6, glibc-headers-2.28-189.8.el8_6
  • RHSA-2023:5455 Released 2023-10-05 · Red Hat rating Important
    glibc security update
    • Red Hat Enterprise Linux AppStream (v. 8) compat-libpthread-nonshared-2.28-225.el8_8.6, glibc-utils-2.28-225.el8_8.6
    • Red Hat Enterprise Linux BaseOS (v. 8) glibc-2.28-225.el8_8.6, glibc-all-langpacks-2.28-225.el8_8.6, glibc-common-2.28-225.el8_8.6 +47
    • Red Hat Enterprise Linux CRB (v. 8) glibc-benchtests-2.28-225.el8_8.6, glibc-nss-devel-2.28-225.el8_8.6, glibc-static-2.28-225.el8_8.6 +1
  • RHSA-2023:5453 Released 2023-10-05 · Red Hat rating Important
    glibc security update
    • Red Hat Enterprise Linux AppStream (v. 9) glibc-devel-2.34-60.el9_2.7, glibc-doc-2.34-60.el9_2.7, glibc-headers-2.34-60.el9_2.7 +2
    • Red Hat Enterprise Linux BaseOS (v. 9) glibc-2.34-60.el9_2.7, glibc-all-langpacks-2.34-60.el9_2.7, glibc-common-2.34-60.el9_2.7 +47
    • Red Hat Enterprise Linux CRB (v. 9) glibc-benchtests-2.34-60.el9_2.7, glibc-nss-devel-2.34-60.el9_2.7, glibc-static-2.34-60.el9_2.7 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 4 more products — RHSA-2023:5453

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2023-04175 Glibc: stack read overflow in getaddrinfo in no-aaaa modePriority LOW 32
    • TI-2023-04430 Glibc: potential use-after-free in gaih_inet()Priority LOW 30
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 4 more products — RHSA-2023:5455

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2023-04175 Glibc: stack read overflow in getaddrinfo in no-aaaa modePriority LOW 32
    • TI-2023-04430 Glibc: potential use-after-free in gaih_inet()Priority LOW 30
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 4 more products — RHSA-2023:7409

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-04430 Glibc: potential use-after-free in gaih_inet()Priority LOW 30
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder EUS (v.8.6)Fixed RHSA-2023:7409
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:5455
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:5453
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:7409
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:5455
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:5453
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:7409
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2023:5455
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:5453
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2023:7409

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4806
  2. 2026-10-03 Alias added: GHSA-5f52-v49r-796w

References

Advisory 5

  • TI-2019-06284 Memory corruption in webkitgtk KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2022-00359 Out-of-bounds write in kernel CVSS 3.1HIGH 8.8
  • TI-2023-28739 Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2023-05404 Postgresql: buffer overrun from integer overflow in array modification CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences