glibc: CVE-2023-5156: Memory leak in getaddrinfo after fix for CVE-2023-4806

[Simon Chopin]

Imported from Debian bug http://bugs.debian.org/1053002:

Source: glibc
Version: 2.37-10
Severity: important
Tags: security upstream
Forwarded: https://sourceware.org/bugzilla/show_bug.cgi?id=30884
X-Debbugs-Cc: <email address hidden>, Debian Security Team <email address hidden>

Hi,

The following vulnerability was published for glibc.

Filling mainly for tracking of the issue.

CVE-2023-5156[0]:
| A flaw was found in the GNU C Library. A recent fix for
| CVE-2023-4806 introduced the potential for a memory leak, which may
| result in an application crash.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-5156
    https://www.cve.org/CVERecord?id=CVE-2023-5156
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=30884

Regards,
Salvatore

[Launchpad Janitor (janitor)]

This bug was fixed in the package glibc - 2.38-1ubuntu5

---------------
glibc (2.38-1ubuntu5) mantic; urgency=medium

  * Update from upstream release branche:
    - CVE-2023-4527: Stack read overflow with large TCP responses in
      no-aaaa mode
    - CVE-2023-4806: use after free in getcanonname
    - LP: #2031909: Fix oversized __io_vtables
  * d/p/u/0001-Fix-leak-in-getaddrinfo-introduced-by-the-fix-for-CV:
    Cherry-picked to fix a regression in one of the previous CVE fixes
    (LP: #2037516, CVE-2023-5156)
  * d/p/lp2032624.patch: add an escape hatch in arm64 math-vector.h.
    This should help fixing multiple FTBFS (LP: #2032624)

 -- Simon Chopin <email address hidden> Wed, 27 Sep 2023 16:38:18 +0200

[Daniel Black (daniel-black)]

The CVE status on https://ubuntu.com/security/CVE-2023-5156 for most Ubuntu Distos is "Deferred" however according to https://git.launchpad.net/ubuntu-cve-tracker/tree/README#n352- "Deferred" says the "package is vulnerable".

As a result of this vulnerable indicator, all ubuntu (non-manic) based container images are being reported as vulnerable on Docker Scout.

e.g.: top CVE on https://hub.docker.com/layers/library/mariadb/latest/images/sha256-7c58576f7e85def1dab9bf216d2de666c72e724aa4a7cf8c8cd5f1f0935827aa?context=explore

A "not-affected" affected classification would be more appropriate.