Executive brief
The GNU C Library (glibc), a fundamental software component used by many Linux-based systems and industrial controllers, contains a flaw in how it handles certain network diagnostic functions. If an application uses these specific functions to process or print specially crafted network data, it could lead to a system crash or memory corruption. This could potentially allow an attacker to disrupt operations or gain unauthorized access to data on affected devices, such as Siemens industrial controllers.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the deprecated glibc functions ns_printrrf, ns_printrr, and fp_nquery. The root cause is a failure to enforce caller-supplied buffer lengths during the processing of TSIG (Transaction Signature) records, specifically within the ns_sprintrrf function which uses a bare sprintf call without bounds checking. While these functions are not part of the default DNS resolver hot path, they are reachable via public libresolv packet-printing APIs. An attacker who can influence the DNS messages processed by an application using these diagnostic interfaces could trigger a buffer overflow of up to 6 bytes. The issue is fixed in glibc version 2.44 and backported to 2.43.
Affected products
- GNU glibc 2.2 through 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Timeline
- 2026-04-02: disclosed: Initial report by researcher 'shinobu'
- 2026-04-28: advisory: GLIBC-SA-2026-0011 published
- 2026-06-19: patched: Fix committed to glibc master branch for version 2.44
- 2026-07-01: patched: Fix backported to glibc 2.43 release branch