[Bug network/34345] res_queriesmatch mishandles ternary return value of res_nameinquery

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=34345

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.45

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for 2.45 via:

commit 1960326bb63e040a2eb9fbb1f322bec90439d3fc
Author: Florian Weimer <fweimer@redhat.com>
Date:   Sat Aug 15 12:03:35 2026 +0200

    resolv: Handle ternary return value in __libc_res_queriesmatch (bug 34345)

    The __libc_res_nameinquery function returns -1 for corrupted packets.
    The previous code treated those as matching.

    This is not a security vulnerability because the transaction ID is
    still checked.  The bug does not  make off-path attacks substantially
    easier.  Furthermore, most users of the DNS stub resolver parse the
    question name again, and do not simply skip over it using dn_skipname
    or similar (which would hide the corruption).  This means that the
    packet is still rejected at a later stage.

    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.