CVE-2023-4813 json
Glibc: potential use-after-free in gaih_inet()
published 2023-09-12 3 y ago modified 2026-11-07 46 h ago also EUVD-2023-54657
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.
Patch / fix
- Red Hat Red Hat Enterprise Linux 8 0:2.28-225.el8_8.6
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:2.28-189.8.el8_6
- Red Hat Red Hat Enterprise Linux 9 0:2.34-60.el9_2.7
- Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 0:2.28-189.8.el8_6
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- glibc Debian 14, Debian 13, Debian 12 2.36-3
debian advisories DEBIAN-CVE-2023-4813
- glibc Ubuntu 20.04 LTS 2.31-0ubuntu9.14
- glibc Ubuntu 22.04 LTS 2.35-0ubuntu3.5
- glibc Ubuntu Pro 16.04 LTS 2.23-0ubuntu11.3+esm5
- glibc Ubuntu Pro 18.04 LTS 2.27-3ubuntu1.6+esm1
ubuntu advisories UBUNTU-CVE-2023-4813
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- glibc RHEL 9 2.34-100.el9
- nscd RHEL 9 2.34-100.el9
- libnsl RHEL 9 2.34-100.el9
- nss_db RHEL 9 2.34-100.el9
- nss_hesiod RHEL 9 2.34-100.el9
- glibc-utils RHEL 9 2.34-100.el9
- glibc-common RHEL 9 2.34-100.el9
- glibc-benchtests RHEL 9 2.34-100.el9
red hat advisories RHBA-2024:2413RHSA-2023:7409RHSA-2023:5453RHSA-2023:5455
- glibc SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Development Tools 15 SP5 +13 more 2.31-150300.63.1
- glibc SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 2.22-114.31.1
- glibc SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +3 more 2.26-150000.13.70.1
suse advisories SUSE-SU-2023:4110-1SUSE-RU-2023:4063-1SUSE-SU-2023:4047-1
- glibc openSUSE Tumbleweed 2.38-6.1
opensuse advisories openSUSE-SU-2024:13388-1
- glibc AlmaLinux 9 2.34-60.el9_2.7
- nscd AlmaLinux 9 2.34-60.el9_2.7
- libnsl AlmaLinux 9 2.34-60.el9_2.7
- nss_db AlmaLinux 9 2.34-60.el9_2.7
- nss_hesiod AlmaLinux 9 2.34-60.el9_2.7
- glibc-utils AlmaLinux 9 2.34-60.el9_2.7
- glibc-common AlmaLinux 9 2.34-60.el9_2.7
- glibc-benchtests AlmaLinux 9 2.34-60.el9_2.7
almalinux advisories ALSA-2023:5453ALSA-2023:5455
- glibc Rocky Linux 8 2.28-225.el8_8.6
rocky linux advisories RLSA-2023:5455
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-4813 updated cvss 5.9
glibc: potential use-after-free in gaih_inet()
-
Red Hat Enterprise Linux 6 nscd, glibc, glibc-utils, compat-glibc, glibc-commonaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 7 nscd, glibc, glibc-utils, compat-glibc, glibc-commonaffected: workaround, no fix planned “Will not fix”
-
Red Hat CodeReady Linux Builder EUS (v.8.6) nss_hesiod 2.28-189.8.el8_6, glibc-benchtests 2.28-189.8.el8_6fixed: vendor fix RHSA-2023:7409
-
Red Hat Enterprise Linux AppStream (v. 8) glibc-utils 2.28-225.el8_8.6, compat-libpthread-nonshared 2.28-225.el8_8.6fixed: vendor fix RHSA-2023:5455
-
Red Hat Enterprise Linux AppStream (v. 9) glibc-utils 2.34-60.el9_2.7, glibc-locale-source 2.34-60.el9_2.7fixed: vendor fix RHSA-2023:5453
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) glibc-utils 2.28-189.8.el8_6, compat-libpthread-nonshared 2.28-189.8.el8_6fixed: vendor fix RHSA-2023:7409
-
Red Hat Enterprise Linux BaseOS (v. 8) nscd 2.28-225.el8_8.6, glibc 2.28-225.el8_8.6, libnsl 2.28-225.el8_8.6, nss_db 2.28-225.el8_8.6, glibc-common 2.28-225.el8_8.6, glibc-gconv-extra 2.28-225.el8_8.6, +3 morefixed: vendor fix RHSA-2023:5455
-
Red Hat Enterprise Linux BaseOS (v. 9) nscd 2.34-60.el9_2.7, glibc 2.34-60.el9_2.7, libnsl 2.34-60.el9_2.7, glibc-common 2.34-60.el9_2.7, glibc-gconv-extra 2.34-60.el9_2.7, glibc-all-langpacks 2.34-60.el9_2.7, +1 morefixed: vendor fix RHSA-2023:5453
show 4 moreshow fewer
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) nscd 2.28-189.8.el8_6, glibc 2.28-189.8.el8_6, libnsl 2.28-189.8.el8_6, nss_db 2.28-189.8.el8_6, glibc-common 2.28-189.8.el8_6, glibc-gconv-extra 2.28-189.8.el8_6, +3 morefixed: vendor fix RHSA-2023:7409
-
Red Hat Enterprise Linux CRB (v. 8) nss_hesiod 2.28-225.el8_8.6, glibc-benchtests 2.28-225.el8_8.6fixed: vendor fix RHSA-2023:5455
-
Red Hat Enterprise Linux CRB (v. 9) nss_db 2.34-60.el9_2.7, nss_hesiod 2.34-60.el9_2.7, glibc-benchtests 2.34-60.el9_2.7fixed: vendor fix RHSA-2023:5453
-
Red Hat Virtualization 4 Hypervisor for RHEL 8 glibc-devel 2.28-189.8.el8_6, glibc-headers 2.28-189.8.el8_6, nscd-debuginfo 2.28-189.8.el8_6, glibc-debuginfo 2.28-189.8.el8_6, libnsl-debuginfo 2.28-189.8.el8_6, nss_db-debuginfo 2.28-189.8.el8_6, +6 morefixed: vendor fix RHSA-2023:7409
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 5.9
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
1.93% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
bugzilla.redhat.com
/show_bug.cgi?id=2237798
issue-tracking, patch, third-party-advisory
-
access.redhat.com
/errata/RHSA-2023:5453
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2023:5455
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2023:7409
vendor-advisory, third-party-advisory
-
access.redhat.com
/security/cve/CVE-2023-4813
vdb-entry, third-party-advisory
- openwall.com /lists/oss-security/2023/10/03/8
- security.netapp.com /advisory/ntap-20231110-0003/
- cert-portal.siemens.com /productcert/html/ssa-398330.html
Sources
- CVE List CVE-2023-4813
- NVD CVE-2023-4813
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.