Executive brief
A vulnerability in the GNU C Library (glibc), a fundamental component of most Linux-based systems, could allow a malicious DNS server to provide misleading information to applications. By sending a specially crafted response, an attacker could cause an application to misidentify a computer's hostname or treat invalid data as a legitimate answer. This could be used to bypass security filters or complicate the investigation of network threats, though it primarily impacts the reliability of system logging and identification.
Technical details
A defect exists in the getanswer_ptr function within glibc's nss_dns backend (resolv/nss_dns/dns-host.c). When processing a DNS response via gethostbyaddr or gethostbyaddr_r, the library may fail to correctly respect the boundary of the 'answer' section if it contains only skipped records followed by a semantically invalid T_PTR record in a subsequent section. This out-of-bounds read/logic error causes the resolver to treat the subsequent section as a valid answer, violating the DNS specification. An attacker with control over a DNS server or the ability to intercept DNS traffic could exploit this to return incorrect hostnames to an application, potentially facilitating security bypasses or obfuscating malicious activity. The issue is fixed in glibc version 2.44 and patched in various vendor distributions.
Affected products
- GNU glibc 2.34 to 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6
Timeline
- 2026-03-20: disclosed: Vulnerability reported to glibc security team
- 2026-03-20: advisory: Initial CVE publication
- 2026-03-30: patched: Fix committed to glibc main branch
- 2026-07-14: other: Siemens updated advisory to include affected industrial controllers