Created attachment 16677 [details] PoCs and gdb logs In the TSIG handling path, the function generally tracks the caller-supplied buflen through helper routines, but one final formatted write is performed without consistently enforcing the remaining length. Under standard API use, this can result in an out-of-bounds write to the caller buffer. In addition, the TSIG/TKEY truncated-RDATA handling lacks sufficient length validation before some fixed-offset reads, which can also lead to out-of-bounds reads. This does not appear to affect the default DNS resolver hot path. Instead, it affects public libresolv packet-printing APIs, so the practical attack surface depends on applications passing untrusted DNS messages to these formatting or diagnostic interfaces. Primary issue: - TSIG path output-side overflow in ns_sprintrrf due to buflen bypass Related issue: - TSIG/TKEY truncated-RDATA fixed-offset reads can trigger out-of-bounds reads Public API reachability: - ns_sprintrrf - ns_sprintrr - fp_nquery I have attached minimal PoCs and gdb logs. Reported-by: shinobu
This issue was reviewed and discussed with the glibc security team. Given that there are no know active exploits, and the functions are deprecated, the choice was made to disclose immediately. The evaluation I conducted is as follows. The code path in question is this one. glibc/resolv/ns_print.c (ns_sprintrrf) 511 case ns_t_tsig: { 512 /* BEW - need to complete this */ 513 int n; 514 515 T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen)); 516 T(addstr(" ", 1, &buf, &buflen)); 517 rdata += 8; /*%< time */ 518 n = ns_get16(rdata); rdata += INT16SZ; 519 rdata += n; /*%< sig */ 520 n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */ 521 sprintf(buf, "%d", ns_get16(rdata)); 522 rdata += INT16SZ; 523 addlen(strlen(buf), &buf, &buflen); 524 break; 525 } This is the only bare sprintf in the function and doesn't count the length written to a temporary buffer. With a minimal reproducer provided by bu shi no I can use valgrind to confirm that ns_sprintrrf uses sprintf to write pas the bounds of the buffer. ==62898== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==62898== Bad permissions for mapped region at address 0x485D000 ==62898== at 0x48E0520: __vsprintf_internal (iovsprintf.c:68) ==62898== by 0x498326A: __sprintf_chk (sprintf_chk.c:40) ==62898== by 0x487353A: sprintf (stdio2.h:30) ==62898== by 0x487353A: ns_sprintrrf (ns_print.c:521) ==62898== by 0x400692: main (ns_sprintrrf_tsig_buflen_overflow_poc.c:47) This means that fp_nquery, ns_sprintrr, ns_sprintrrf and may write past the bounds of either an internally allocated buffer in the case of fp_nquery or caller provided buffers in the case of ns_psrintrrf and ns_sprintrr. The impact is considered low because these are debugging functions that have been marked deprecated since glibc 2.34 (2021-08-02), are for debugging purposes, and are not in the default path of code executed by the DNS resolver. CVE identifier CVE-2026-5435 is reserved for this issue as we prepare to publish.
Lack of error checking on inet_ntop is also suspect: (void) inet_ntop(AF_INET, rdata, buf, buflen); addlen(strlen(buf), &buf, &buflen); I believe the subsequent strlen can read beyond the end of buf if the remaining part does not happen to contain a null byte. I expect this results in an assertion failure in addlen. This needs to be reported to ISC. Not sure if libbind is still maintained, though.
The assert failure does not actually happen because a null byte is written to the buffer before the inet_ntop call (via addname/addstr), and the current and old inet_ntop implementations do not modify the buffer on failure. According to this, libbind is now maintained by NetBSD: “ The handoff of the maintainership from ISC to NetBSD happened in July 2013. ” <https://wiki.netbsd.org/individual-software-releases/netresolv/> I've sent a note to the NetBSD security team.
https://github.com/NetBSD/src/commit/ef0ba218705910e85cced4498e837b677477a35b
I'm working on a fix.
Patches posted: [PATCH 0/5] Fixes for CVE-2026-5435, CVE-2026-6238 <https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/>
The master branch has been updated by Florian Weimer <fw@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ca44a6609c29a683b03575fa035c6d17aa591e72 commit ca44a6609c29a683b03575fa035c6d17aa591e72 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Fixed for 2.44 so far.
Updated the CVE record with vulnerable versions from 2.0.1 to 2.43. We never released a 1.90 other than experimental for testing. While 2.0.1 was also experimental it was released on the official distribution channels to I reference it in the advisory and data.
The release/2.43/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e64ae5a591f0604b7504df4df631857bb11cc78b commit e64ae5a591f0604b7504df4df631857bb11cc78b Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
The release/2.42/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227 commit 299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
The release/2.41/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0e8c56b386d72ba2ddf15784423f2e894c63a241 commit 0e8c56b386d72ba2ddf15784423f2e894c63a241 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)