The RDATA length is not validated while parsing LOC, CERT, TKEY, TSIG, and A6 records. Applications using the deprecated ns_sprintrrf, ns_sprintrr, fp_nquery may encounter crashes or read uninitialized memory when processing corrupted DNS packets where the RDATA contents is not structured correctly. Found while writing a test case for bug 34033.
Patches posted: [PATCH 0/5] Fixes for CVE-2026-5435, CVE-2026-6238 <https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/>
The master branch has been updated by Florian Weimer <fw@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ca44a6609c29a683b03575fa035c6d17aa591e72 commit ca44a6609c29a683b03575fa035c6d17aa591e72 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The master branch has been updated by Florian Weimer <fw@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a7b60d23bbb56eaef59f4962e4140062e552600a commit a7b60d23bbb56eaef59f4962e4140062e552600a Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) Check that the RDATA payload does not require more than RDATALEN bytes while processing it. The fixes cover A6, LOC records. (CERT, TKEY, TSIG were fixed before, by switching to the generic formatter.) The vulnerable LOC record handling was first introduced before glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. CERT, TSIG, TKEY handling came with commit b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. A6 record handling was introduced in commit 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc 2.7. This fixes bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
The master branch has been updated by Florian Weimer <fw@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4ba0b79b9596e5a4951cc9eaa1546a55e543e083 commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069) This test case covers both input buffer overreads and output buffer overflows. It should systematically cover these issues. I used code auto-generation for updating the test expectations for truncated RDATA in TXT, ISDN records, after writing the rest of the test by hand. Assisted-by: LLM Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Fixed for 2.44 so far.
The release/2.43/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e64ae5a591f0604b7504df4df631857bb11cc78b commit e64ae5a591f0604b7504df4df631857bb11cc78b Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
The release/2.43/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3a418da6a3938756763980541e440dbdd46900fb commit 3a418da6a3938756763980541e440dbdd46900fb Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) Check that the RDATA payload does not require more than RDATALEN bytes while processing it. The fixes cover A6, LOC records. (CERT, TKEY, TSIG were fixed before, by switching to the generic formatter.) The vulnerable LOC record handling was first introduced before glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. CERT, TSIG, TKEY handling came with commit b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. A6 record handling was introduced in commit 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc 2.7. This fixes bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
The release/2.43/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8759917de589b125a08f63653170dfcb3de4df31 commit 8759917de589b125a08f63653170dfcb3de4df31 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069) This test case covers both input buffer overreads and output buffer overflows. It should systematically cover these issues. I used code auto-generation for updating the test expectations for truncated RDATA in TXT, ISDN records, after writing the rest of the test by hand. Assisted-by: LLM Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083)
The release/2.42/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227 commit 299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
The release/2.42/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=cb4c62448047c043981deea84e5e01eccf8b36d4 commit cb4c62448047c043981deea84e5e01eccf8b36d4 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) Check that the RDATA payload does not require more than RDATALEN bytes while processing it. The fixes cover A6, LOC records. (CERT, TKEY, TSIG were fixed before, by switching to the generic formatter.) The vulnerable LOC record handling was first introduced before glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. CERT, TSIG, TKEY handling came with commit b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. A6 record handling was introduced in commit 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc 2.7. This fixes bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
The release/2.42/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=296fb7f4a2b35db13efef52609f8efc00291b2a8 commit 296fb7f4a2b35db13efef52609f8efc00291b2a8 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069) This test case covers both input buffer overreads and output buffer overflows. It should systematically cover these issues. I used code auto-generation for updating the test expectations for truncated RDATA in TXT, ISDN records, after writing the rest of the test by hand. Assisted-by: LLM Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083)
The release/2.41/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0e8c56b386d72ba2ddf15784423f2e894c63a241 commit 0e8c56b386d72ba2ddf15784423f2e894c63a241 Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
The release/2.41/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=05e1eaea619072a92ff1f5fefe1ac2dd5758829c commit 05e1eaea619072a92ff1f5fefe1ac2dd5758829c Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) Check that the RDATA payload does not require more than RDATALEN bytes while processing it. The fixes cover A6, LOC records. (CERT, TKEY, TSIG were fixed before, by switching to the generic formatter.) The vulnerable LOC record handling was first introduced before glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. CERT, TSIG, TKEY handling came with commit b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. A6 record handling was introduced in commit 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc 2.7. This fixes bug 34069. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
The release/2.41/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ca40a1976888c62c3de02a3d3341282ce7590b4a commit ca40a1976888c62c3de02a3d3341282ce7590b4a Author: Florian Weimer <fweimer@redhat.com> Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069) This test case covers both input buffer overreads and output buffer overflows. It should systematically cover these issues. I used code auto-generation for updating the test expectations for truncated RDATA in TXT, ISDN records, after writing the rest of the test by hand. Assisted-by: LLM Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083)