Bug 2234712 (CVE-2023-4527)

Summary: CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acrosby, adudiak, agarcial, aoconnor, asegurap, ashankar, bdettelb, caswilli, codonell, dfreiber, dhalasz, dj, dkuc, fjansen, fweimer, ganandan, ggastald, hkataria, jburrell, jmitchel, jsamir, jsherril, jtanner, kaycoth, kshier, luizcosta, mcermak, mcoufal, nweather, pfrankli, psegedy, rogbas, sbiarozk, security-response-team, sipoyare, skolosov, stcannon, sthirugn, tcarlin, tkasparek, vkrizan, vkumar, vmugicag, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2234713, 2234714, 2234715, 2234716, 2238600    
Bug Blocks: 2234719    

Description Mauro Matteo Cascella 2023-08-25 08:25:31 UTC 
If the system is configured in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC address family, and a DNS response is received over TCP that is larger than 2048 bytes, getaddrinfo may potentially disclose stack contents via the returned address data, or crash. While name lookup normally just fails incorrectly, crashes are not difficult to trigger, with valid DNS responses that are propagated by DNS resolvers.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=30842
Comment 5 Guilherme de Almeida Suckevicz 2023-09-12 17:26:15 UTC 
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 2238600]
Comment 6 errata-xmlrpc 2023-10-05 13:54:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5453 https://access.redhat.com/errata/RHSA-2023:5453
Comment 7 errata-xmlrpc 2023-10-05 14:01:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:5455 https://access.redhat.com/errata/RHSA-2023:5455