GNU C Library 2.38 Call Graph Monitor gmon.c __monstartup 内存损坏 ⚔ [有争议]

在GNU C Library 2.38中曾发现一漏洞, 此漏洞被申报为棘手。 此漏洞会影响功能 __monstartup文件gmon.c的组件Call Graph Monitor。 手动调试的不合法输入可导致 内存损坏。 使用CWE来声明会导致 CWE-120 的问题。 此漏洞的脆弱性 2023-02-06由公示人Leo Yuriev、公示人身份Bug 29444、公示人类型为Bug Report所发布。 索取公告的网址是sourceware.org。 该漏洞被命名为CVE-2023-0687， 攻击必须在本地进行。 有技术细节可用。 没有可利用漏洞。 目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。 它被宣布为未定义。 估计零日攻击的地下价格约为$0-$5k。 目前，此漏洞是否真实存在尚存疑惑。 错误修复程序下载地址为patchwork.sourceware.org， 建议采用一个补丁来修正此问题。 该漏洞被披露后，此前未曾发表过可能的缓解措施。

时间轴

用户

156
412733

字段

source_cve_nvd_summary3
vulnerability_cvss3_meta_tempscore3
vulnerability_cvss3_meta_basescore3
vulnerability_risk3
exploit_price_0day2

Commit Conf

90%42
70%26
50%13
100%12

Approve Conf

90%43
70%26
80%13
100%9
ID已提交用户字段更改备注已接受地位C
148447932023-10-05VulD...cve_nvd_summary** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.cve.org2023-10-05已接受
100
148447922023-10-05VulD...historic02023-10-05已接受
100
137630462023-03-05VulD...cve_nvd_summary** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.cvedetails.com2023-03-05已接受
70
137630452023-03-05VulD...cvss3_cna_basescore4.6see CVSS documentation2023-03-05已接受
90
137630442023-03-05VulD...cvss3_nvd_basescore9.8nist.gov2023-03-05已接受
90
137630432023-03-05VulD...cvss2_nvd_basescore4.0nist.gov2023-03-05已接受
90
137630422023-03-05VulD...cvss3_meta_tempscore6.2see CVSS documentation2023-03-05已接受
90
137630412023-03-05VulD...cvss3_meta_basescore6.3see CVSS documentation2023-03-05已接受
90
137630402023-03-05VulD...cve_cnaVulDBnvd.nist.gov2023-03-05已接受
70
137630392023-03-05VulD...cvss3_cna_aLnvd.nist.gov2023-03-05已接受
70
137630382023-03-05VulD...cvss3_cna_iLnvd.nist.gov2023-03-05已接受
70
137630372023-03-05VulD...cvss3_cna_cLnvd.nist.gov2023-03-05已接受
70
137630362023-03-05VulD...cvss3_cna_sUnvd.nist.gov2023-03-05已接受
70
137630352023-03-05VulD...cvss3_cna_uiNnvd.nist.gov2023-03-05已接受
70
137630342023-03-05VulD...cvss3_cna_prLnvd.nist.gov2023-03-05已接受
70
137630332023-03-05VulD...cvss3_cna_acHnvd.nist.gov2023-03-05已接受
70
137630322023-03-05VulD...cvss3_cna_avAnvd.nist.gov2023-03-05已接受
70
137630312023-03-05VulD...cvss2_nvd_aiPnvd.nist.gov2023-03-05已接受
70
137630302023-03-05VulD...cvss2_nvd_iiPnvd.nist.gov2023-03-05已接受
70
137630292023-03-05VulD...cvss2_nvd_ciPnvd.nist.gov2023-03-05已接受
70

73 更多条目未显示

🔒 Login Required

You need to signup and login to see more of the remaining 73 results.

◂ 上一步一览下一步 ▸

Might our Artificial Intelligence support you?

Check our Alexa App!