CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow

This document (7017265) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 12

SUSE Linux Enterprise Server 11 Service Pack 4 (SLES 11 SP4)
SUSE Linux Enterprise Server 11 Service Pack 3 (SLES 11 SP3)
SUSE Linux Enterprise Server 11 Service Pack 2 LTSS (SLES 11 SP2 LTSS)

Expanded Support 6 (RES 6)
Expanded Support 7 (RES 7)

SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 11 Service Pack 4 (SLED 11 SP4)

Situation

During upstream review of the public open Bug#18665 for glibc, it was discovered that the bug could lead to a stack-based buffer overlow.

The buffer overflow occurs in the functions send_dg (UDP) and send_vc (TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family.

The use of AF_UNSPEC triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the allocated buffer created by __res_nquery.

Resolution

SUSE Linux Enterprise 11 and 12 as well as RES6 and RES7 are affected by this bug. SUSE has already released patches for this problem:

SLES 12 SP1 & SLED 12 SP1
glibc-2.19-35.1 has been released on the 16th of February 2016
SLES 12 & SLED 12
glibc-2.19-22.13.1 has been released 16th of February 2016
SLES 11 SP4 & SLED 11 SP4
glibc-2.11.3-17.95.2 has been released 16th of February 2016
SLES 11 SP3 LTSS
glibc-2.11.3-17.95.2 has been released 16th of February 2016
SLES 11 SP2 LTSS
glibc-2.11.3-17.45.66.1 has been released 16th of February 2016
SLE 10
not affected (only glibc 2.9 or later)
RES6 / RES7
RES7: glibc-2.17-106.el7_2.4.i686.rpm has been released 18th of February 2016
RES6: glibc-2.12-1.166.el6_7.7.i686.rpm has been released 18th of February 2016

Systems have to be patched with the provided versions to be safe.

Cause

Additional Information

CVE-2015-7547

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.