GNU glibc
CVE-2023-6246
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain local shell on glibc 2.36+ host
-
DeliveryIdentify setuid binary invoking syslog without openlog
-
Exploitexecve binary with argv[0] basename >1024 bytes
-
InstallOverflow heap allocation in __vsyslog_internal
-
C2Corrupt heap metadata via public exploit
-
ExecuteHijack control flow within privileged process
-
ImpactGain root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution as an unprivileged user on a host running glibc 2.36 or newer, plus the presence of a setuid or setgid binary that calls syslog() or vsyslog() without first calling openlog() with a non-NULL ident - these are the exact preconditions stated in the description. The attacker must invoke that binary via execve so they control argv[0], and the basename of argv[0] must exceed 1024 bytes to trigger the overflow. Limiting factors: the CVSS vector is AV:L (no network reachability), exploitation is impossible from a remote unauthenticated position, glibc versions below 2.36 are not vulnerable, and hosts with no suitable setuid syslog-calling binary in their PATH offer no useful escalation primitive even though the libc bug is present. |
| Impact | The CVSS 8.4 score with AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H reflects full local compromise without prior privileges or user interaction - a profile that aligns well with practical setuid abuse. EPSS at 25.48% (96th percentile) is unusually high for a local-only flaw and is consistent with the public availability of working exploit code, which materially raises real-world risk. The vulnerability is not currently listed in CISA KEV, so there is no confirmation of active exploitation by named threat actors; the signal mix (high EPSS + public POC + no KEV) suggests it is a likely candidate for post-compromise privilege escalation in real intrusions rather than mass internet-facing exploitation. The CVSS local vector is consistent with the description's requirement to control argv[0] via execve of a setuid binary, so signals are coherent rather than conflicting. SSVC-style factors are not provided in the input, but technical impact is clearly Total (root) and exploitation is presumed Proof-of-Concept based on the publicly available exploit. |
| Exploit ScenarioDerived | A local unprivileged user logs into a Linux host running glibc 2.36+ (e.g., Fedora 38/39), then execve's a setuid-root binary that calls syslog without first calling openlog with a non-NULL ident, passing an attacker-crafted argv[0] whose basename exceeds 1024 bytes. The oversized program name triggers a heap overflow inside __vsyslog_internal during early process initialization, and using the publicly available exploit code the attacker corrupts heap metadata to redirect execution and gain a root shell. The attack requires only shell access on the target and no user interaction from any other principal. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, reachable via the syslog/vsyslog interfaces when openlog was not called (or called with a NULL ident) and argv[0]'s basename exceeds 1024 bytes. Any setuid/setgid binary on affected Linux distributions (including Fedora 38 and 39) that invokes syslog can be leveraged by a local attacker to crash the process or escalate privileges to root. Publicly available exploit code exists and EPSS sits at the 96th percentile, signaling meaningful real-world risk despite the local attack vector.
RemediationAI
Upgrade glibc to a distribution-provided patched build as the primary fix: track and apply the vendor errata for your platform (e.g., Fedora updates for F38/F39 referenced from the Red Hat advisory and Bodhi, and equivalent DSA/USN/RHSA advisories from Debian, Ubuntu, and Red Hat). Where immediate patching is not feasible, the most effective compensating control is to reduce the setuid/setgid attack surface - audit setuid binaries with find / -perm -4000 and remove the setuid bit from non-essential binaries (trade-off: some admin tooling may break for non-root users), and consider mounting /tmp, /home, and user-writable filesystems with nosuid to prevent attacker-controlled setuid binaries from being staged. Mandatory access control via SELinux in enforcing mode or AppArmor profiles can further constrain post-exploitation, though it does not block the overflow itself. Disabling syslog usage in vulnerable programs is not a practical workaround since the affected function is invoked internally by libc consumers; do not rely on argv[0] length filtering at the shell layer because the attack uses execve directly.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
glibc is the GNU C Library, the standard C library underpinning virtually every userland process on mainstream Linux distributions. The flaw resides in __vsyslog_internal, the shared backend for the syslog(3) and vsyslog(3) APIs defined in syslog.h. When a process never calls openlog (or passes ident=NULL), the implementation derives the log identifier from the basename of argv[0]; the affected code path miscomputes the heap buffer size needed to hold this identifier, allowing an attacker-controlled program name longer than 1024 bytes to overflow an allocation on the heap. This is a classic CWE-122 heap-based buffer overflow, and because argv[0] is attacker-controlled across an execve boundary, any setuid/setgid binary that ultimately calls syslog without first calling openlog with a non-NULL ident is exploitable. CPE data confirms upstream gnu:glibc and Fedora 38/39 as in-scope, and the issue was introduced in glibc 2.36, so distributions shipping that or newer (e.g., Fedora 36+, Debian trixie, recent Ubuntu) inherit the vulnerable code path.
Know when Glibc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
Executive ViewAI
GNU glibc versions 2.36 and newer contain a local privilege escalation vulnerability affecting any setuid/setgid binary that invokes syslog functionality. Local users can escalate to root privileges; publicly available exploit code exists, and no patch is currently available from vendors.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Strip setuid/setgid bits from unnecessary binaries (chmod u-s,g-s); (2) Enforce restricted local user access policies; (3) Deploy mandatory access control (AppArmor/SELinux) to confine setuid binary capabilities; (4) Enable system call auditing (auditd) to detect exploitation via __vsyslog_internal; (5) Establish daily patch monitoring across distributions to deploy when vendor fixes become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)CVE.org
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in
GitHub PoC
Exploit-DB