What is the CVSS score of CVE-2023-6779?

CVE-2023-6779 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.7%.

Which versions of GNU glibc are affected by CVE-2023-6779?

A critical vulnerability in glibc 2.37+ (CVE-2023-6779, CVSS 8.2) impacts the core system library relied upon by numerous enterprise applications for logging.

Is there a public PoC exploit available for CVE-2023-6779?

Yes, a public proof-of-concept exploit is available for CVE-2023-6779. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2023-6779?

Within 24 hours: Audit systems running glibc 2.37 or later and identify applications using syslog functions with external input sources. Within 7 days: Implement input validation and strict message size limits (below INT_MAX threshold) for all syslog handlers; establish monitoring to detect oversized syslog messages indicative of exploitation attempts. Within 30 days: Deploy compensating controls (see below); subscribe to glibc security advisories and prepare test environments for vendor patch deployment immediately upon release.

GNU glibc CVE-2023-6779

HIGH

Heap-based Buffer Overflow (CWE-122)

2024-01-31 secalert@redhat.com

Heap Overflow Buffer Overflow Glibc Fedora

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

DescriptionCVE.org

An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer.

AnalysisAI

Heap-based off-by-one buffer overflow in glibc's __vsyslog_internal function affects versions 2.37 and newer, triggered when syslog() or vsyslog() are invoked with messages exceeding INT_MAX bytes. Remote attackers can cause application crashes (denial of service) and potentially impact integrity in applications that log attacker-controlled data via syslog. Publicly available exploit code exists, though EPSS exploitation probability remains moderate at 0.65% (71st percentile) and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in __vsyslog_internal, a core internal helper inside the GNU C Library that backs the POSIX syslog() and vsyslog() interfaces used by virtually every Linux userspace process for logging. The root cause is CWE-122 (heap-based buffer overflow), specifically an off-by-one error in size calculation: when a log message larger than INT_MAX bytes is passed in, integer arithmetic produces an incorrect buffer length, causing a one-byte heap overrun when the message is written. Affected CPEs explicitly include gnu:glibc (all matching versions 2.37+), and Fedora 38 and Fedora 39, both of which ship glibc 2.37/2.38 in their base distributions. Because glibc is foundational, the bug surfaces in any application that forwards externally influenced strings into syslog without length capping.

RemediationAI

Upgrade affected systems to a glibc version containing the upstream fix in __vsyslog_internal - Patch available per vendor advisory, with downstream packages distributed via Fedora's bodhi updates for Fedora 38 and 39 and Red Hat errata tracked under the secalert@redhat.com reporter channel; consult your distribution's security tracker for the exact patched glibc package version applicable to your release. As a compensating control where prompt patching is not possible, audit applications that pass untrusted input directly to syslog()/vsyslog() and enforce a strict message length cap well below INT_MAX (e.g., truncate to a few kilobytes before logging), which has the side effect of losing very long log lines but eliminates the trigger; additionally, restricting which network-exposed services can reach syslog with attacker-controlled data (via input validation at the application boundary or WAF rules) reduces exposure at the cost of additional rule maintenance.