Cyber Resilience

CVE-2023-4813

Medium

Published: 12 September 2023

Published
12 September 2023
Modified
26 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0034 56.9th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-4813 is a medium-severity Use After Free (CWE-416) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.9 (Medium).

Operationally, ranked in the top 43.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts…

more

database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

CWE(s)
CWE-416

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gnu
glibc
≤ 2.36
redhat
enterprise linux
8.0, 9.0
redhat
enterprise linux eus
8.8, 9.2
redhat
enterprise linux for ibm z systems eus s390x
9.2
redhat
enterprise linux for ibm z systems s390x
9.2
redhat
enterprise linux for power little endian
9.2_ppc64le
redhat
enterprise linux for power little endian eus
9.2_ppc64le
redhat
enterprise linux server aus
9.2
redhat
enterprise linux server tus
8.8
fedoraproject
fedora
38
+6 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-16 Memory Protection
addresses: CWE-416

Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.

References