[Bug network/33802] Uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=33802

--- Comment #4 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Carlos O'Donell from comment #1)
> The glibc security team evaluated this to have security impact.
> 
> There is no known application impact.
> 
> The scenario where stack contents are leaked requires an application calling
> gethostbyaddr with net 0x0 and an attacker being able to control when that

Should be "getnetbyaddr". Apologies.

> occurs in the calling thread to lead the stack contents. This is very
> complex and unlikely to occur.

-- 
You are receiving this mail because:
You are on the CC list for the bug.