[Bug network/34069] Buffer overread in ns_sprintrrf with corrupted RDATA field (CVE-2026-6238)

https://sourceware.org/bugzilla/show_bug.cgi?id=34069

--- Comment #7 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.43/master branch has been updated by Aurelien Jarno
<[email protected]>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3a418da6a3938756763980541e440dbdd46900fb

commit 3a418da6a3938756763980541e440dbdd46900fb
Author: Florian Weimer <[email protected]>
Date:   Fri Jun 19 18:22:20 2026 +0200

    resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)

    Check that the RDATA payload does not require more than RDATALEN
    bytes while processing it.  The fixes cover A6, LOC records.
    (CERT, TKEY, TSIG were fixed before, by switching to the generic
    formatter.)

    The vulnerable LOC record handling was first introduced before
    glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.

    CERT, TSIG, TKEY handling came with commit
    b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.

    A6 record handling was introduced in commit
    91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
    (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
    2.7.

    This fixes bug 34069.

    Reviewed-by: Carlos O'Donell <[email protected]>
    Reviewed-by: Adhemerval Zanella <[email protected]>
    (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)

-- 
You are receiving this mail because:
You are on the CC list for the bug.