Stack-based buffer overflow in libeconf - CVE-2023-30079

Vulnerability identifier: #VU80059

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30079

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the read_file() function in atlibeconf/lib/getfilecontents.c. A remote unauthenticated attacker can trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libeconf
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Basesystem Module
openSUSE Leap
Fedora
Red Hat OpenShift Kernel Module Management
Migration Toolkit for Virtualization
Red Hat Migration Toolkit for Applications
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libeconf (Red Hat package)
libeconf
libeconf-debugsource
libeconf0-debuginfo
libeconf0
libeconf0-32bit
libeconf0-64bit-debuginfo
libeconf0-64bit
libeconf0-32bit-debuginfo
libeconf-utils-debuginfo
libeconf-utils
libeconf-devel
ObjectScale
Dell EMC VxRail Appliance

Install updates from vendor's website.

libeconf - update to 0.5.2
Red Hat OpenShift Kernel Module Management - update to 1.1.2
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat Migration Toolkit for Applications - update to 6.2.1
libeconf (Red Hat package) - update to 0.4.1-3.el9_0
libeconf - addressed in versions 0.5.2-1.fc37, 0.5.2-1.fc38, 0.5.2-1.fc39, 0.5.2-1.fc40
libeconf-debugsource - addressed in versions 0.5.2-150300.3.11.1, 0.5.2-150400.3.6.1
libeconf0-debuginfo - addressed in versions 0.5.2-150300.3.11.1, 0.5.2-150400.3.6.1
libeconf0 - addressed in versions 0.5.2-150300.3.11.1, 0.5.2-150400.3.6.1
libeconf0-32bit - update to 0.5.2-150400.3.6.1
libeconf0-64bit-debuginfo - update to 0.5.2-150400.3.6.1
libeconf0-64bit - update to 0.5.2-150400.3.6.1
libeconf0-32bit-debuginfo - update to 0.5.2-150400.3.6.1
libeconf-utils-debuginfo - update to 0.5.2-150400.3.6.1
libeconf-utils - update to 0.5.2-150400.3.6.1
libeconf-devel - update to 0.5.2-150400.3.6.1
ObjectScale - update to 1.4.0
Dell EMC VxRail Appliance - update to 8.0.120

• https://raw.githubusercontent.com/yangjiageng/PoC/master/libeconf-PoC/tst-logindefs1.c
• https://github.com/openSUSE/libeconf/issues/177
• https://github.com/yangjiageng/PoC/blob/master/libeconf-PoC/read_file_503

• Multiple vulnerabilities in libeconf
• Fedora 40 update for libeconf
• Fedora 38 update for libeconf
• Fedora 37 update for libeconf
• Fedora 39 update for libeconf
• SUSE update for libeconf
• SUSE update for libeconf
• Red Hat Enterprise Linux 9.0 Extended Update Support update for libeconf
• SUSE update for libeconf
• Multiple vulnerabilities in Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• Multiple vulnerabilities in Red Hat OpenShift Kernel Module Management 1.1
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell ObjectScale