What’s Vulnerable › Vulnerabilities

CVE-2023-4813: Glibc: potential use-after-free in gaih_inet()

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-12 · updated 2026-10-30
• Weakness: CWE-416

Description

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Affected products

• Fedoraproject Fedora: 38 (and their updates)
• GNU C Library (glibc): before 2.36 — fixed in 2.36
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions
• Red Hat Enterprise Linux: 8.0, 9.0 (and their updates)
• RedHat Enterprise Linux Eus: 8.8, 9.2 (and their updates)
• RedHat Enterprise Linux For Ibm Z Systems Eus S390X: 9.2 (and their updates)
• RedHat Enterprise Linux For Ibm Z Systems S390X: 9.2 (and their updates)
• RedHat Enterprise Linux For Power Little Endian: 9.2_ppc64le (and their updates)
• RedHat Enterprise Linux For Power Little Endian Eus: 9.2_ppc64le (and their updates)
• RedHat Enterprise Linux Server Aus: 9.2 (and their updates)
• RedHat Enterprise Linux Server Tus: 8.8 (and their updates)
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions — fixed in 0:2.28-225.el8_8.6
• Red Hat Enterprise Linux 8.6 Extended Update Support: all versions — fixed in 0:2.28-189.8.el8_6
• Red Hat Enterprise Linux 9: all versions — fixed in 0:2.34-60.el9_2.7
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 8: all versions — fixed in 0:2.28-189.8.el8_6

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.36; Red Hat Enterprise Linux 8 0:2.28-225.el8_8.6; Red Hat Enterprise Linux 8.6 Extended Update Support 0:2.28-189.8.el8_6; Red Hat Enterprise Linux 9 0:2.34-60.el9_2.7; Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 0:2.28-189.8.el8_6. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:5453
• https://access.redhat.com/errata/RHSA-2023:5455
• https://access.redhat.com/errata/RHSA-2023:7409
• https://access.redhat.com/security/cve/CVE-2023-4813
• https://bugzilla.redhat.com/show_bug.cgi?id=2237798
• http://www.openwall.com/lists/oss-security/2023/10/03/8
• https://access.redhat.com/errata/RHSA-2023:5453
• https://access.redhat.com/errata/RHSA-2023:5455
• https://access.redhat.com/errata/RHSA-2023:7409
• https://access.redhat.com/security/cve/CVE-2023-4813
• https://bugzilla.redhat.com/show_bug.cgi?id=2237798
• https://security.netapp.com/advisory/ntap-20231110-0003/

Get alerted when CVE-2023-4813 or the next vulnerability affects your stack