[to-be-committed] Document CVE-2026-6238

[Andreas Schwab]

On Apr 28 2026, Florian Weimer wrote:

> * Carlos O'Donell:
>
>> On 4/28/26 12:45 AM, Florian Weimer wrote:
>>> * Siddhesh Poyarekar:
>>> 
>>>> Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
>>>> ---
>>>>   advisories/GLIBC-SA-2026-0012 | 18 ++++++++++++++++++
>>>>   1 file changed, 18 insertions(+)
>>>>   create mode 100644 advisories/GLIBC-SA-2026-0012
>>>>
>>>> diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012
>>>> new file mode 100644
>>>> index 0000000000..29498d905e
>>>> --- /dev/null
>>>> +++ b/advisories/GLIBC-SA-2026-0012
>>>> @@ -0,0 +1,18 @@
>>>> +Buffer overread in ns_printrrf with corrupted RDATA field
>>>> +
>>>> +The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the
>>>> +GNU C Library version 2.2 and newer fail to validate the RDATA content
>>>> +against the RDATA length in a DNS response when processing LOC, CERT,
>>>> +TKEY or TSIG records, which may allow an attacker to craft a DNS
>>>> +response, causing a target application to crash or read uninitialized
>>>> +memory.
>>> Note that this code was present in glibc before 2.2.
>>>          case T_LOC: {
>>>                  char t[255];
>>>                  (void) fprintf(file, "\t%s", loc_ntoa(cp, t));
>>>                  cp += dlen;
>>>                  break;
>>>              }
>>> It's in the tree that is tagged glibc-1.90.
>>
>> May you please propose a different Vulnerable-Commit with updated text?
>>
>> We can keep updating the advisories with more accurate information as
>> we receive it from reviewers.
>
> It's not helpful because of the imperfect CVS conversion:
>
> commit ee188d555b8c32ad9704a7440cab400af967292f
> Author: Roland McGrath <roland@gnu.org>
> Date:   Wed Jun 5 01:07:21 1996 +0000

In git://repo.or.cz/glibc/history, it's commit 132922b488.

commit 132922b488
Author: Roland McGrath <roland@gnu.org>
Date:   Wed Jun 5 01:04:13 1996 +0000

    Wed Jun  5 02:11:30 1996  Ulrich Drepper  <drepper@cygnus.com>
    
            * resolv/res_debug.c, resolv/resolv.h: Update from bind-4.3.4-T4A.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."