Out-of-bounds read in gawk - CVE-2023-4156

Vulnerability identifier: #VU79963

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4156

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in builtin.c. A local user can trigger an out-of-bounds read error and read contents of memory on the system.

gawk
ObjectScale
Cloud Pak for Data System - Cyclops
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
gawk (Ubuntu package)
gawk-debuginfo
gawk-debugsource
gawk
gawk-help
gawk-devel
gawk-lang
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
Dell EMC VxRail Appliance
IBM CICS TX Advanced
Dell EMC NetWorker vProxy

Install updates from vendor's website.

gawk - update to 5.1.1
gawk (Ubuntu package) - addressed in versions Ubuntu Pro, 1:5.0.1+dfsg-1ubuntu0.1, 1:5.1.0-1ubuntu0.1
ObjectScale - update to 1.4.0
gawk-debuginfo - addressed in versions 4.1.0-5.3.1, 4.2.1-150000.3.3.1
gawk-debugsource - addressed in versions 4.1.0-5.3.1, 4.2.1-150000.3.3.1
gawk - addressed in versions 4.1.0-5.3.1, 4.2.1-150000.3.3.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
EMC ViPR SRM - update to 4.10.0.0
gawk - update to 5.0.1-5
gawk-help - update to 5.0.1-5
gawk-devel - update to 5.0.1-5
gawk-debuginfo - update to 5.0.1-5
gawk-debugsource - update to 5.0.1-5
gawk-lang - update to 5.0.1-5
gawk - update to 5.1.0-3
Dell EMC VxRail Appliance - update to 8.0.120
IBM CICS TX Advanced - update to 10.1.0.0 ifix24
Cloud Pak for Data System - Cyclops - update to 11.3.1.1
Dell EMC NetWorker vProxy - addressed in versions 19.9.0.4, 19.10

• https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00000.html
• https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00023.html
• https://bugzilla.redhat.com/show_bug.cgi?id=2215930

• Out-of-bounds read in GNU gawk
• SUSE update for gawk
• SUSE update for gawk
• Ubuntu update for gawk
• Dell EMC NetWorker vProxy update for third-party components
• Out-of-bounds read in IBM CICS TX Advanced
• openEuler update for gawk
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell ObjectScale
• Amazon Linux AMI update for gawk
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM Cloud Pak for Data System - Cyclops