SB2026032376 - Spoofing attack in GNU C Library

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-4438)

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation when calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library. A remote attacker can force the library to violate the DNS specification and retrieve an invalid DNS hostname to the caller, leading to a potential spoofing attack.

2) Out-of-bounds read (CVE-ID: CVE-2026-4437)

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to a boundary condition when calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version. A remote attacker can send a specially crafted response from the configured DNS server and perform a spoofing attack.

Remediation

Install update from vendor's website.

References

• https://sourceware.org/bugzilla/show_bug.cgi?id=34015
• https://sourceware.org/bugzilla/show_bug.cgi?id=34014