GNU C Library 2.38 Call Graph Monitor gmon.c __monstartup 内存损坏 ⚔ [有争议]

在GNU C Library 2.38中曾发现一漏洞, 此漏洞被申报为棘手。 此漏洞会影响功能 __monstartup文件gmon.c的组件Call Graph Monitor。 手动调试的不合法输入可导致 内存损坏。 使用CWE来声明会导致 CWE-120 的问题。 此漏洞的脆弱性 2023-02-06由公示人Leo Yuriev、公示人身份Bug 29444、公示人类型为Bug Report所发布。 索取公告的网址是sourceware.org。 该漏洞被命名为CVE-2023-0687， 攻击必须在本地进行。 有技术细节可用。 没有可利用漏洞。 目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。 它被宣布为未定义。 估计零日攻击的地下价格约为$0-$5k。 目前，此漏洞是否真实存在尚存疑惑。 错误修复程序下载地址为patchwork.sourceware.org， 建议采用一个补丁来修正此问题。 该漏洞被披露后，此前未曾发表过可能的缓解措施。

字段2023-03-05 13時10分2023-03-05 13時16分2023-10-05 13時42分
vendorGNUGNUGNU
nameC LibraryC LibraryC Library
version2.382.382.38
componentCall Graph MonitorCall Graph MonitorCall Graph Monitor
filegmon.cgmon.cgmon.c
function__monstartup__monstartup__monstartup
cwe120 (内存损坏)120 (内存损坏)120 (内存损坏)
risk111
cvss3_vuldb_acHHH
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifierBug 29444Bug 29444Bug 29444
urlhttps://sourceware.org/bugzilla/show_bug.cgi?id=29444https://sourceware.org/bugzilla/show_bug.cgi?id=29444https://sourceware.org/bugzilla/show_bug.cgi?id=29444
name补丁补丁补丁
patch_urlhttps://patchwork.sourceware.org/project/glibc/patch/20230204114138.5436-1-leo@yuriev.ru/https://patchwork.sourceware.org/project/glibc/patch/20230204114138.5436-1-leo@yuriev.ru/https://patchwork.sourceware.org/project/glibc/patch/20230204114138.5436-1-leo@yuriev.ru/
cveCVE-2023-0687CVE-2023-0687CVE-2023-0687
responsibleVulDBVulDBVulDB
date1675638000 (2023-02-06)1675638000 (2023-02-06)1675638000 (2023-02-06)
typeSoftware LibrarySoftware LibrarySoftware Library
cvss2_vuldb_acHHH
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_avLLL
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_avLLL
cvss3_vuldb_prLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_eXXX
cvss2_vuldb_basescore3.53.53.5
cvss2_vuldb_tempscore3.03.03.0
cvss3_vuldb_basescore4.54.54.5
cvss3_vuldb_tempscore4.34.34.3
cvss3_meta_basescore6.36.36.3
cvss3_meta_tempscore6.26.26.2
price_0day$0-$5k$0-$5k$0-$5k
typeBug ReportBug ReportBug Report
person_nameLeo YurievLeo YurievLeo Yuriev
disputed111
freeformen
response_summaryThe inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.
cve_assigned1675638000 (2023-02-06)1675638000 (2023-02-06)1675638000 (2023-02-06)
cve_nvd_summary** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.
cvss3_nvd_avNNN
cvss3_nvd_acLLL
cvss3_nvd_prNNN
cvss3_nvd_uiNNN
cvss3_nvd_sUUU
cvss3_nvd_cHHH
cvss3_nvd_iHHH
cvss3_nvd_aHHH
cvss2_nvd_avAAA
cvss2_nvd_acHHH
cvss2_nvd_auSSS
cvss2_nvd_ciPPP
cvss2_nvd_iiPPP
cvss2_nvd_aiPPP
cvss3_cna_avAAA
cvss3_cna_acHHH
cvss3_cna_prLLL
cvss3_cna_uiNNN
cvss3_cna_sUUU
cvss3_cna_cLLL
cvss3_cna_iLLL
cvss3_cna_aLLL
cve_cnaVulDBVulDBVulDB
cvss2_nvd_basescore4.04.04.0
cvss3_nvd_basescore9.89.89.8
cvss3_cna_basescore4.64.64.6
historic0

◂ 上一步一览下一步 ▸

Might our Artificial Intelligence support you?

Check our Alexa App!