Bug 2234712 (CVE-2023-4527)

Summary:	CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acrosby, adudiak, agarcial, aoconnor, asegurap, ashankar, bdettelb, caswilli, codonell, dfreiber, dhalasz, dj, dkuc, fjansen, fweimer, ganandan, ggastald, hkataria, jburrell, jmitchel, jsamir, jsherril, jtanner, kaycoth, kshier, luizcosta, mcermak, mcoufal, nweather, pfrankli, psegedy, rogbas, sbiarozk, security-response-team, sipoyare, skolosov, stcannon, sthirugn, tcarlin, tkasparek, vkrizan, vkumar, vmugicag, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-10-10 08:13:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2234713, 2234714, 2234715, 2234716, 2238600
Bug Blocks:	2234719

Description Mauro Matteo Cascella 2023-08-25 08:25:31 UTC

If the system is configured in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC address family, and a DNS response is received over TCP that is larger than 2048 bytes, getaddrinfo may potentially disclose stack contents via the returned address data, or crash. While name lookup normally just fails incorrectly, crashes are not difficult to trigger, with valid DNS responses that are propagated by DNS resolvers.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=30842

Comment 5 Guilherme de Almeida Suckevicz 2023-09-12 17:26:15 UTC

Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 2238600]

Comment 6 errata-xmlrpc 2023-10-05 13:54:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:5453 https://access.redhat.com/errata/RHSA-2023:5453

Comment 7 errata-xmlrpc 2023-10-05 14:01:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:5455 https://access.redhat.com/errata/RHSA-2023:5455