diff options
| author | Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:10:56 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2023-09-13 14:37:57 +0200 |
| commit | 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f (patch) | |
| tree | 201fcf59f1ca9923fb3597b97d60caaa7453c1b2 /NEWS | |
| parent | f441cb9a70fa3f55e9bbd615924879d692d21a6c (diff) | |
| download | glibc-4ea972b7edd7e36610e8cde18bf7a8149d7bac4f.tar.gz glibc-4ea972b7edd7e36610e8cde18bf7a8149d7bac4f.tar.xz glibc-4ea972b7edd7e36610e8cde18bf7a8149d7bac4f.zip | |
CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
Without passing alt_dns_packet_buffer, __res_context_search can only
store 2048 bytes (what fits into dns_packet_buffer). However,
the function returns the total packet size, and the subsequent
DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
of the stack-allocated buffer.
Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
stub resolver option") and bug 30842.
(cherry picked from commit bd77dd7e73e3530203be1c52c8a29d08270cb25d)
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/NEWS b/NEWS index fd9d34b9b4..c1456869ad 100644 --- a/NEWS +++ b/NEWS @@ -21,6 +21,12 @@ Security related changes: heap and prints it to the target log file, potentially revealing a portion of the contents of the heap. + CVE-2023-4527: If the system is configured in no-aaaa mode via + /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC address + family, and a DNS response is received over TCP that is larger than + 2048 bytes, getaddrinfo may potentially disclose stack contents via + the returned address data, or crash. + The following bugs are resolved with this release: [12154] Do not fail DNS resolution for CNAMEs which are not host names @@ -65,6 +71,7 @@ The following bugs are resolved with this release: [30477] libc: [RISCV]: time64 does not work on riscv32 [30515] _dl_find_object incorrectly returns 1 during early startup [30785] Always call destructors in reverse constructor order + [30842] Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) Version 2.36 |