Well, here's another reminder to keep your PC up to date. Despite Linux being known for security, it's not perfect (no software is) and researchers at Qualys have discovered multiple vulnerabilities in the GNU C Library.
They said the issues were confirmed on Debian (versions 12 and 13), Ubuntu (23.04 and 23.10), and Fedora (37 to 39) but that other distributions are also likely affected by it.
What they said sounds a little alarming noting "four significant vulnerabilities" with the first being noted as CVE-2023-6246, which is the most severe as it allows "local privilege escalation, enabling an unprivileged user to gain full root access". Two more issues were discovered during this noted as:
- CVE-2023-6779 (glibc): This vulnerability involves an off-by-one heap-based buffer overflow in the __vsyslog_internal() function.
- CVE-2023-6780 (glibc): This is an integer overflow issue in the __vsyslog_internal() function.
But they said actually triggering those "appears more challenging than CVE-2023-6246" and so "exploiting them effectively is likely to be more complex". Another memory corruption issue was also discovered, but they didn't note a CVE number for it.
More about the most severe of the group CVE-2023-6246:
This vulnerability identified is a heap-based buffer overflow within the __vsyslog_internal() function of the GNU C Library, also known as glibc. This critical function underpins the widely-used syslog() and vsyslog() functions. The buffer overflow issue, traced back to the introduction of glibc version 2.37, poses a significant threat as it could allow local privilege escalation, enabling an unprivileged user to gain full root access through crafted inputs to applications that employ these logging functions. Although the vulnerability requires specific conditions to be exploited (such as an unusually long argv[0] or openlog() ident argument), its impact is significant due to the widespread use of the affected library. Interestingly, a similar issue was reported in December 1997 in an older Linux libc version.
See their full article on it for more info. Nice to see a responsible disclosure with the researchers sending all the details to the relevant people.
Article taken from GamingOnLinux.com.
fenglengshun Jan 31
Though, I'd assume Flatpak runtimes will need to update as well? Although the risk should be lower there with all the mitigation they have.
hardpenguin Feb 1
Exercise caution and follow best practices to keep yourself reasonably safe but don't become obsessed about it (unless you keep highly sensitive data).
Patreon
PayPal
See more from me