CVE-2023-4806: Fedoraproject Fedora

Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days.

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Affected products

  • Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
  • GNU Glibc: version 2.33 only
  • Red Hat Codeready Linux Builder Eus: version 9.2 only
  • Red Hat Codeready Linux Builder Eus For Power Little Endian: version 9.0_ppc64le only
  • Red Hat Codeready Linux Builder Eus For Power Little Endian Eus: version 9.2_ppc64le only
  • Red Hat Codeready Linux Builder For ARM64: version 9.0_aarch64 only
  • Red Hat Codeready Linux Builder For ARM64 Eus: version 9.2_aarch64 only
  • Red Hat Codeready Linux Builder For IBM Z Systems: version 9.0_s390x only
  • Red Hat Codeready Linux Builder For IBM Z Systems Eus: version 9.2_s390x only
  • Red Hat Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only
  • Red Hat Enterprise Linux Eus: version 8.8 only; version 9.2 only
  • Red Hat Enterprise Linux For Arm 64: version 9.0_aarch64 only
  • Red Hat Enterprise Linux For Arm 64 Eus: version 9.2_aarch64 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 8.0_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.8_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus s390x: version 9.2 only
  • Red Hat Enterprise Linux For IBM Z Systems s390x: version 9.2 only
  • Red Hat Enterprise Linux For Power Little Endian: version 8.0_ppc64le only; version 9.2_ppc64le only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 8.8_ppc64le only; version 9.2_ppc64le only
  • Red Hat Enterprise Linux Server Aus: version 9.2 only
  • Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 9.2_ppc64le only
  • Red Hat Enterprise Linux Tus: version 8.8 only

Published 2023-09-18. Last modified 2026-07-14.