diff mbox series

[COMMITTED,4/4] Document CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780

Message ID 20240130184045.511720-4-arjun@redhat.com
State Committed
Commit 6cdc44214253a74e7140d75a7ebfc900820a5fa8
Headers
Series [COMMITTED,1/4] syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246) |

Commit Message

Arjun Shankar Jan. 30, 2024, 6:40 p.m. UTC 
  This commit adds "advisories" entries for the above three CVEs.
---
 advisories/GLIBC-SA-2024-0001 | 15 +++++++++++++++
 advisories/GLIBC-SA-2024-0002 | 15 +++++++++++++++
 advisories/GLIBC-SA-2024-0003 | 13 +++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 advisories/GLIBC-SA-2024-0001
 create mode 100644 advisories/GLIBC-SA-2024-0002
 create mode 100644 advisories/GLIBC-SA-2024-0003
diff mbox series

Patch

diff --git a/advisories/GLIBC-SA-2024-0001 b/advisories/GLIBC-SA-2024-0001
new file mode 100644
index 0000000000..28931c75ae
--- /dev/null
+++ b/advisories/GLIBC-SA-2024-0001
@@ -0,0 +1,15 @@ 
+syslog: Heap buffer overflow in __vsyslog_internal
+
+__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
+containing a long program name failed to update the required buffer
+size, leading to the allocation and overflow of a too-small buffer on
+the heap.
+
+CVE-Id: CVE-2023-6246
+Public-Date: 2024-01-30
+Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
+Fix-Commit: 6bd0e4efcc78f3c0115e5ea9739a1642807450da (2.39)
+Fix-Commit: 23514c72b780f3da097ecf33a793b7ba9c2070d2 (2.38-42)
+Fix-Commit: 97a4292aa4a2642e251472b878d0ec4c46a0e59a (2.37-57)
+Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
+Fix-Commit: d1a83b6767f68b3cb5b4b4ea2617254acd040c82 (2.36-126)
diff --git a/advisories/GLIBC-SA-2024-0002 b/advisories/GLIBC-SA-2024-0002
new file mode 100644
index 0000000000..940bfcf2fc
--- /dev/null
+++ b/advisories/GLIBC-SA-2024-0002
@@ -0,0 +1,15 @@ 
+syslog: Heap buffer overflow in __vsyslog_internal
+
+__vsyslog_internal used the return value of snprintf/vsnprintf to
+calculate buffer sizes for memory allocation.  If these functions (for
+any reason) failed and returned -1, the resulting buffer would be too
+small to hold output.
+
+CVE-Id: CVE-2023-6779
+Public-Date: 2024-01-30
+Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
+Fix-Commit: 7e5a0c286da33159d47d0122007aac016f3e02cd (2.39)
+Fix-Commit: d0338312aace5bbfef85e03055e1212dd0e49578 (2.38-43)
+Fix-Commit: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 (2.37-58)
+Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
+Fix-Commit: 2bc9d7c002bdac38b5c2a3f11b78e309d7765b83 (2.36-127)
diff --git a/advisories/GLIBC-SA-2024-0003 b/advisories/GLIBC-SA-2024-0003
new file mode 100644
index 0000000000..b43a5150ab
--- /dev/null
+++ b/advisories/GLIBC-SA-2024-0003
@@ -0,0 +1,13 @@ 
+syslog: Integer overflow in __vsyslog_internal
+
+__vsyslog_internal calculated a buffer size by adding two integers, but
+did not first check if the addition would overflow.
+
+CVE-Id: CVE-2023-6780
+Public-Date: 2024-01-30
+Vulnerable-Commit: 52a5be0df411ef3ff45c10c7c308cb92993d15b1 (2.37)
+Fix-Commit: ddf542da94caf97ff43cc2875c88749880b7259b (2.39)
+Fix-Commit: d37c2b20a4787463d192b32041c3406c2bd91de0 (2.38-44)
+Fix-Commit: 2b58cba076e912961ceaa5fa58588e4b10f791c0 (2.37-59)
+Vulnerable-Commit: b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9 (2.36-16)
+Fix-Commit: b9b7d6a27aa0632f334352fa400771115b3c69b7 (2.36-128)