rpms/glibc
7
0
Fork 2
Code Issues Pull Requests Releases Activity

CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141849)

Browse Source 
Resolves: RHEL-141849
This commit is contained in:
Florian Weimer 2026-01-16 18:34:14 +01:00
parent d99d6389d8
commit 73087c4259
2 changed files with 75 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
glibc-RHEL-141849.patch Normal file
View File

@ -0,0 +1,70 @@
commit e56ff82d5034ec66c6a78f517af6faa427f65b0b
Author: Carlos O'Donell <carlos@redhat.com>
Date: Thu Jan 15 15:09:38 2026 -0500
resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)
The default network value of zero for net was never tested for and
results in a DNS query constructed from uninitialized stack bytes.
The solution is to provide a default query for the case where net
is zero.
Adding a test case for this was straight forward given the existence of
tst-resolv-network and if the test is added without the fix you observe
this failure:
FAIL: resolv/tst-resolv-network
original exit status 1
error: tst-resolv-network.c:174: invalid QNAME: \146\218\129\128
error: 1 test failures
With a random QNAME resulting from the use of uninitialized stack bytes.
After the fix the test passes.
Additionally verified using wireshark before and after to ensure
on-the-wire bytes for the DNS query were as expected.
No regressions on x86_64.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
diff --git a/resolv/nss_dns/dns-network.c b/resolv/nss_dns/dns-network.c
index 61bddd754f2d73c0..cbab554f1e761016 100644
--- a/resolv/nss_dns/dns-network.c
+++ b/resolv/nss_dns/dns-network.c
@@ -207,6 +207,10 @@ _nss_dns_getnetbyaddr_r (uint32_t net, int type, struct netent *result,
sprintf (qbuf, "%u.%u.%u.%u.in-addr.arpa", net_bytes[3], net_bytes[2],
net_bytes[1], net_bytes[0]);
break;
+ default:
+ /* Default network (net is originally zero). */
+ strcpy (qbuf, "0.0.0.0.in-addr.arpa");
+ break;
}
net_buffer.buf = orig_net_buffer = (querybuf *) alloca (1024);
diff --git a/resolv/tst-resolv-network.c b/resolv/tst-resolv-network.c
index 4b862d57e65276e5..afc1874160179fcc 100644
--- a/resolv/tst-resolv-network.c
+++ b/resolv/tst-resolv-network.c
@@ -46,6 +46,9 @@ handle_code (const struct resolv_response_context *ctx,
{
switch (code)
{
+ case 0:
+ send_ptr (b, qname, qclass, qtype, "0.in-addr.arpa");
+ break;
case 1:
send_ptr (b, qname, qclass, qtype, "1.in-addr.arpa");
break;
@@ -259,6 +262,9 @@ do_test (void)
"error: NO_RECOVERY\n");
/* Lookup by address, success cases. */
+ check_reverse (0,
+ "name: 0.in-addr.arpa\n"
+ "net: 0x00000000\n");
check_reverse (1,
"name: 1.in-addr.arpa\n"
"net: 0x00000001\n");

6
glibc.spec
View File

@ -115,7 +115,7 @@ end \
Summary: The GNU libc libraries
Name: glibc
Version: %{glibcversion}
Release: %{glibcrelease}.27
Release: %{glibcrelease}.28
# In general, GPLv2+ is used by programs, LGPLv2+ is used for
# libraries.
@ -1295,6 +1295,7 @@ Patch1060: glibc-RHEL-72011-5.patch
Patch1061: glibc-RHEL-72011-6.patch
Patch1062: glibc-RHEL-72011-7.patch
Patch1063: glibc-RHEL-72011-8.patch
Patch1064: glibc-RHEL-141849.patch
##############################################################################
# Continued list of core "glibc" package information:
@ -2956,6 +2957,9 @@ fi
%{_libdir}/libpthread_nonshared.a
%changelog
* Fri Jan 16 2026 Florian Weimer <fweimer@redhat.com> - 2.28-251.28
- CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141849)
* Thu Nov 20 2025 Arjun Shankar <arjun@redhat.com> - 2.28-251.27
- Fix a segmentation fault in multi-threaded multi-namespace programs using
ctype.h macros (RHEL-72011)