diff options
| author | Carlos O'Donell <carlos@systemhalted.org> | 2016-02-16 21:26:37 -0500 |
|---|---|---|
| committer | Carlos O'Donell <carlos@systemhalted.org> | 2016-02-16 21:29:32 -0500 |
| commit | e9db92d3acfe1822d56d11abcea5bfc4c41cf6ca (patch) | |
| tree | 67e2907fdad7c2a466e1aa996d48495c6016e3b3 /ChangeLog | |
| parent | 2c8f75f79bd6f3f4b3400a9f1a01a75e3086006b (diff) | |
CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Bug 18665).
* A stack-based buffer overflow was found in libresolv when invoked from
libnss_dns, allowing specially crafted DNS responses to seize control
of execution flow in the DNS client. The buffer overflow occurs in
the functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family. The use of AF_UNSPEC triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of the
buffers used for those queries could result in the response of a query
writing beyond the alloca allocated buffer created by
_nss_dns_gethostbyname4_r. Buffer management is simplified to remove
the overflow. Thanks to the Google Security Team and Red Hat for
reporting the security impact of this issue, and Robert Holiday of
Ciena for reporting the related bug 18665. (CVE-2015-7547)
See also:
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
https://sourceware.org/ml/libc-alpha/2016-02/msg00418.html
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 17 |
1 files changed, 16 insertions, 1 deletions
@@ -1,4 +1,19 @@ -2016-02-14 Carlos O'Donelll <carlos@redhat.com> +2016-02-15 Carlos O'Donell <carlos@redhat.com> + + [BZ #18665] + * resolv/nss_dns/dns-host.c (gaih_getanswer_slice): Always set + *herrno_p. + (gaih_getanswer): Document functional behviour. Return tryagain + if any result is tryagain. + * resolv/res_query.c (__libc_res_nsearch): Set buffer size to zero + when freed. + * resolv/res_send.c: Add copyright text. + (__libc_res_nsend): Document that MAXPACKET is expected. + (send_vc): Document. Remove buffer reuse. + (send_dg): Document. Remove buffer reuse. Set *thisanssizp to set the + size of the buffer. Add Dprint for truncated UDP buffer. + +2016-02-14 Carlos O'Donell <carlos@redhat.com> * manual/install.texi: Latest tested is GCC 5.3, texinfo 6.0, gawk 4.1.3, and sed 4.2.2. Remove po2test.sed comments. |