[Bug network/34345] res_queriesmatch mishandles ternary return value of res_nameinquery
fweimer at redhat dot com via Glibc-bugs <[email protected]>
| Newsgroups | gmane.comp.lib.glibc.bugs |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
https://sourceware.org/bugzilla/show_bug.cgi?id=34345
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution|--- |FIXED
Target Milestone|--- |2.45
--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for 2.45 via:
commit 1960326bb63e040a2eb9fbb1f322bec90439d3fc
Author: Florian Weimer <[email protected]>
Date: Sat Aug 15 12:03:35 2026 +0200
resolv: Handle ternary return value in __libc_res_queriesmatch (bug 34345)
The __libc_res_nameinquery function returns -1 for corrupted packets.
The previous code treated those as matching.
This is not a security vulnerability because the transaction ID is
still checked. The bug does not make off-path attacks substantially
easier. Furthermore, most users of the DNS stub resolver parse the
question name again, and do not simply skip over it using dn_skipname
or similar (which would hide the corruption). This means that the
packet is still rejected at a later stage.
Reviewed-by: Adhemerval Zanella <[email protected]>
--
You are receiving this mail because:
You are on the CC list for the bug.