CVE-2023-4813

MEDIUM

Glibc: potential use-after-free in gaih_inet()

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-4813 has a selected CVSS score of 5.9 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

8
ProductSourceVersion range

Red Hat Enterprise Linux 6

Browse Red Hat / Red Hat Enterprise Linux 6compat-glibc

Default status: unknown

CVE ListVersion data not supplied

Red Hat Enterprise Linux 6

Browse Red Hat / Red Hat Enterprise Linux 6glibc

Default status: unknown

CVE ListVersion data not supplied

Red Hat Enterprise Linux 7

Browse Red Hat / Red Hat Enterprise Linux 7compat-glibc

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux 7

Browse Red Hat / Red Hat Enterprise Linux 7glibc

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux 8

Browse Red Hat / Red Hat Enterprise Linux 8glibc

Default status: affected

CVE List0:2.28-225.el8_8.6 to < *unaffected

Red Hat Enterprise Linux 8.6 Extended Update Support

Browse Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Supportglibc

Default status: affected

CVE List0:2.28-189.8.el8_6 to < *unaffected

Red Hat Enterprise Linux 9

Browse Red Hat / Red Hat Enterprise Linux 9glibc

Default status: affected

CVE List0:2.34-100.el9 to < *unaffected
0:2.34-60.el9_2.7 to < *unaffected

Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Browse Red Hat / Red Hat Virtualization 4 for Red Hat Enterprise Linux 8glibc

Default status: affected

CVE List0:2.28-189.8.el8_6 to < *unaffected

Proofs of concept

1

Repository PoCs

GitHubtnishiox/cve-2023-4813Repository PoCby tnishiox2Not analyzed3 files

2.2 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

tnishiox/cve-2023-4813Created Vuln labCVE-2023-4813Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds an AlmaLinux 8.8-minimal container that modifies nsswitch.conf and runs a binary named cve-2023-4813 against a target host.

Dockerfile:1-18

Lab assessment

Vulnerability lab

The repository name, README, and Dockerfile all reference CVE-2023-4813, and the container executes a binary with that name, consistent with a vulnerability reproduction or exploit exercise.

README.md:1Dockerfile:1-18
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

almalinux:8.8-minimal base image

operating system base

Provides the minimal AlmaLinux 8.8 environment in which the exercise runs.

Dockerfile:2

nsswitch.conf modification

vulnerability precondition

Changes the hosts line in /etc/nsswitch.conf to prioritize DNS with a continue-on-success action before files, likely setting up the vulnerable condition for CVE-2023-4813.

Dockerfile:5

cve-2023-4813 binary

exploit or proof-of-concept

A binary copied into the container and executed with arguments 'example.org 10'. Its behavior is uninspected; it is named after the target CVE.

Dockerfile:8Dockerfile:11Dockerfile:14
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-4813

Insufficient evidence

The packet associates CVE-2023-4813 via repository name, README, and binary name, but provides no description of the vulnerability, no exploit code, and no runtime behavior; the binary is uninspected.

README.md:1Dockerfile:8
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • The container must be built with the local cve-2023-4813 binary present in the build context.Dockerfile:8
  • The nsswitch.conf modification must be applied to set up the vulnerable hosts resolution order.Dockerfile:5

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile, which modifies nsswitch.conf and copies the cve-2023-4813 binary.Dockerfile:1-18
  2. Run the container, which executes the cve-2023-4813 binary with arguments 'example.org 10'.Dockerfile:14
Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The binary cve-2023-4813 is uninspected; its runtime behavior, network targets, and potential side effects are unknown. No evidence of harm or safety can be determined.

Dockerfile:8Dockerfile:14
Review boundaries

What the analysis did not establish

  • The cve-2023-4813 binary is uninspected; its behavior, network connections, and potential host/external impact are unknown.
  • No runtime output, exploit description, or vulnerability details are provided.
  • The Dockerfile does not expose ports, mount volumes, or use privileged mode, but the binary's actions cannot be assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

9