[Bug network/34346] New: Uninitialized data read in DNS stub resolver during QNAME comparison

https://sourceware.org/bugzilla/show_bug.cgi?id=34346

            Bug ID: 34346
           Summary: Uninitialized data read in DNS stub resolver during
                    QNAME comparison
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

The send_dg function calls __libc_res_queriesmatch with the whole buffer size
as an argument, not the size of the part that was previously written by the
recvfrom function. As a result, parts of the checks that
__libc_res_queriesmatch performs may be based on previous buffer contents.

I don't think this is a security vulnerability because it only allows
confirmation of previously existing buffer values. All reads stay within the
specified buffer bounds. The buffer contents may not have been initialized.
Subsequent processing is correctly capped at buffer bounds, too.

-- 
You are receiving this mail because:
You are on the CC list for the bug.