CVE-2023-6246: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in the GNU C Library's _vsysloginternal() function, which is called by both syslog() and vsyslog() functions. The vulnerability (CVE-2023-6246) was introduced in glibc 2.37 (August 2022) and backported to glibc 2.36. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes. The vulnerability affects multiple Linux distributions including Debian 12 and 13, Ubuntu 23.04 and 23.10, and Fedora 37 to 39 (Qualys Advisory).

The vulnerability exists in the vsyslog_internal() function where if LogTag is NULL, it uses progname (the basename of argv[0]). When a local attacker controls argv[0], the return value of snprintf() can exceed 1024 bytes, causing the code to skip important buffer size calculations. This results in allocating a very small 1-byte buffer that gets overflowed with attacker-controlled data. The overflow occurs in two stages: first with the attacker-controlled progname, and then with a format string due to incorrect buffer size calculations (Qualys Advisory).

The vulnerability can lead to local privilege escalation, allowing an unprivileged user to gain full root privileges. While the vulnerability primarily affects local systems, it cannot be triggered remotely in typical scenarios as it requires an argv[0] or openlog() ident argument longer than 1024 bytes. The vulnerability has been successfully exploited on an up-to-date, default installation of Fedora 38 on amd64 architecture (Qualys Advisory, Red Hat CVE).

The vulnerability has been patched in glibc 2.39 and backported to affected versions. System administrators should update their glibc packages to the latest available version. For Fedora systems, updates can be installed using the dnf package manager. Debian and other affected distributions have also released security updates to address this vulnerability (Gentoo Security, Fedora Update).