CVE-2023-52159: 
NixOS vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability was discovered in gross versions 0.9.3 through 1.x before 1.0.4. The vulnerability affects the grossd daemon and was introduced in code that first appeared in version 0.9.3 (Gross Wiki).

The vulnerability stems from improper use of the strncat() function when composing log entries. The third argument was incorrectly specified as the full length of the destination buffer instead of the maximal length of string that can be appended to it. The affected log entries contain values such as message sender, recipient addresses, and SMTP client HELO name, which are provided by an SMTP client (Gross Wiki).

This vulnerability can cause a crash of the grossd daemon resulting in denial of service. If the software was compiled without stack smashing protector, there is a theoretical possibility of arbitrary code execution (Gross Wiki, NVD).

The vulnerability is remotely exploitable as an attacker can trigger it by manipulating SMTP transaction parameters such as sender address, recipient address, and HELO name (Gross Wiki).

The vulnerability has been addressed in gross version 1.0.4. Users are strongly encouraged to upgrade to this version. Various Linux distributions have also released security updates, including Ubuntu with version 1.0.2-4ubuntu0.24.04.1 and Debian with version 1.0.2-4.1~deb10u1 (Ubuntu Notice, Debian LTS).