Bug 1215280 (CVE-2023-4527) - VUL-0: CVE-2023-4527: glibc: stack read overflow in getaddrinfo() in no-aaaa mode
Summary: VUL-0: CVE-2023-4527: glibc: stack read overflow in getaddrinfo() in no-aaaa ...
Status: RESOLVED FIXED
Alias: CVE-2023-4527
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Andreas Schwab
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/377993/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-4527:7.5:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-13 07:35 UTC by Carlos López
Modified: 2024-05-13 14:38 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2023-09-13 07:35:39 UTC 
CVE-2023-4527

If the system is configured in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC address family, and a DNS response is received over TCP that is larger than 2048 bytes, getaddrinfo may potentially disclose stack contents via the returned address data, or crash. While name lookup normally just fails incorrectly, crashes are not difficult to trigger, with valid DNS responses that are propagated by DNS resolvers.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=30842

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4527
https://bugzilla.redhat.com/show_bug.cgi?id=2234712
Comment 1 Carlos López 2023-09-13 07:37:56 UTC 
no-aaaa mode was introduced in v2.36:
https://sourceware.org/pipermail/libc-alpha/2022-August/141193.html

So this should only affect:
- SUSE:ALP:Source:Standard:1.0 (v2.37)
- openSUSE:Factory (v2.38)
Comment 2 OBSbugzilla Bot 2023-09-18 09:45:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1215280) was mentioned in
https://build.opensuse.org/request/show/1111922 Factory / glibc
Comment 6 Marcus Meissner 2024-05-13 14:38:22 UTC 
done