CVE-2023-45918

What it actually does

NULL pointer dereference in tgetstr within tinfo/lib_termcap.c causes memory corruption and potential application crash when processing certain terminal capability strings.

Why it matters to the business

Applications relying on ncurses for terminal handling may crash unexpectedly, leading to service interruptions and degraded user experience in environments using terminal-based interfaces.

How an attack unfolds

An attacker supplies a crafted terminal description or environment that triggers tgetstr to receive a NULL pointer, resulting in dereference and crash; no public exploitation or threat actor usage is known given the age and lack of KEV status.

How to fix it

Upgrade ncurses to fixed versions such as 6.4+20230625-1 or later on affected platforms; rebuild and redeploy dependent applications after the library update.

How to confirm the fix worked

Confirm ncurses package version meets or exceeds the fixed release, run regression tests exercising tgetstr paths with varied terminal capabilities, and monitor for absence of crashes under load.

Typical attack path

1. Identify applications using vulnerable ncurses version for terminal handling
2. Craft malicious TERM or terminal capability data
3. Trigger tgetstr call with the malformed input
4. Cause NULL dereference leading to process crash

How to detect it

Review application crash logs for segmentation faults originating from ncurses tinfo functions; examine core dumps or stack traces referencing lib_termcap.c around tgetstr calls.

What your security team should do

• Prioritize patching ncurses in all environments within standard maintenance windows
• Inventory applications linked against ncurses and schedule upgrades
• Monitor upstream Debian and ncurses release notes for any related issues