Design/Logic Flaw

2023-09-1817:15:00

PRIOn knowledge base

www.prio-n.com

glibc

getaddrinfo

af_unspec

no-aaaa mode

dns response

tcp

stack contents

crash.

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

CPENameOperatorVersion
fedoraeq37
fedoraeq38
fedoraeq39
glibclt2.39
codeready_linux_builder_euseq9.2
codeready_linux_builder_eus_for_power_little_endianeq9.0.0-ppc64-le
codeready_linux_builder_eus_for_power_little_endian_euseq9.2.0-ppc64-le
codeready_linux_builder_for_arm64eq9.0.0-aarch64
codeready_linux_builder_for_arm64_euseq9.2.0-aarch64
codeready_linux_builder_for_ibm_z_systemseq9.0.0-s390-x

Name	Operator	Version
fedora	eq	37
fedora	eq	38
fedora	eq	39
glibc	lt	2.39
codeready_linux_builder_eus	eq	9.2
codeready_linux_builder_eus_for_power_little_endian	eq	9.0.0-ppc64-le
codeready_linux_builder_eus_for_power_little_endian_eus	eq	9.2.0-ppc64-le
codeready_linux_builder_for_arm64	eq	9.0.0-aarch64
codeready_linux_builder_for_arm64_eus	eq	9.2.0-aarch64
codeready_linux_builder_for_ibm_z_systems	eq	9.0.0-s390-x