5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-4806

CVE-2023-4806: Glibc: potential use-after-free in getaddrinfo()

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-4806

CVE-2023-4806:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-4806 is a use-after-free in glibc's getaddrinfo function. The provided commit 973fe93a5675c42798b2161c6f29c01b0e243994 directly patches sysdeps/posix/getaddrinfo.c. The commit message explicitly states 'getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)'.

The analysis of the patch reveals that the core issue lies in how getaddrinfo handles the h_name field from struct hostent returned by NSS modules, particularly when a temporary buffer (tmpbuf) backing this h_name is reallocated or freed.

getaddrinfo is the main, user-facing function. The complex logic involving multiple calls to NSS modules (e.g., gethostbyname2_r, then getcanonname_r) and buffer management happens within its implementation. The vulnerability occurs because getaddrinfo's internal state management allowed a pointer to h_name (stored in res->at->name before the fix) to become dangling if tmpbuf was freed, and this dangling pointer was subsequently used.
The internal static function getcanonname was identified as the point where the stale pointer (previously at->name) was passed to the NSS _getcanonname_r hook. The patch changes getcanonname to use a safely copied version of h_name (res->h_name).

Other modified functions like convert_hostent_to_gaih_addrtuple and get_nss_addresses are part of the fix mechanism (e.g., copying h_name, passing the copied version) but getaddrinfo is the encompassing vulnerable function, and getcanonname is the internal function that directly used the stale pointer before passing it to the NSS hook. The new test files (nss_test_gai_hv2_canonname.c, tst-nss-gai-hv2-canonname.c) are for reproducing the bug and are not part of the vulnerable glibc code itself.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.