Report
CVE-2023-6246: glibc syslog heap buffer overflow in __vsyslog_internal
611f45b2-245d-49b9-8ea1-651f271dee2e
A heap buffer overflow exists in glibc's syslog implementation (CVE-2023-6246) within the __vsyslog_internal function. When a syslog message is too large for the static 1024-byte stack buffer, the code falls back to malloc. However, the malloc allocation size is calculated incorrectly: it allocates only the header size (variable l) instead of the total size needed for header + formatted message body. This causes a heap overflow when the code attempts to write the formatted message to a buffer that is too small.