CVE-2026-0915
📋 TL;DR
This vulnerability in GNU C Library (glibc) allows stack memory contents to be leaked to DNS resolvers when getnetbyaddr functions query for a zero-valued network with DNS backend configured. It affects systems using glibc versions 2.0 through 2.42 with specific nsswitch.conf configurations.
💻 Affected Systems
- GNU C Library (glibc)
📦 What is this software?
Glibc by Gnu
The GNU C Library (glibc) is the core C library for Linux systems, providing essential system calls and basic functions for all C programs. It is a fundamental component that nearly every Linux application depends on.
Learn more about Glibc →⚠️ Risk & Real-World Impact
Worst Case
Sensitive stack memory containing passwords, keys, or other secrets could be transmitted to untrusted DNS resolvers, leading to credential theft or further system compromise.
Likely Case
Limited information disclosure of stack contents to DNS resolvers, potentially exposing internal memory structures but requiring specific conditions to be useful to attackers.
If Mitigated
With proper network segmentation and trusted DNS infrastructure, impact is limited to internal information disclosure within controlled environments.
🎯 Exploit Status
Exploitation requires specific application behavior and configuration. No known public exploits at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: glibc 2.43 or later
Vendor Advisory: https://sourceware.org/bugzilla/show_bug.cgi?id=33802
Restart Required: Yes
Instructions:
1. Update glibc to version 2.43 or later. 2. For distributions: Use package manager (apt-get upgrade libc6, yum update glibc, etc.). 3. Restart affected services or reboot system.
🔧 Temporary Workarounds
Disable DNS backend for networks
linuxModify nsswitch.conf to remove DNS backend for network resolution
sed -i 's/^networks:.*dns.*/networks: files/' /etc/nsswitch.conf
Block outgoing DNS queries
linuxPrevent applications from making DNS queries for network resolution
iptables -A OUTPUT -p udp --dport 53 -j DROP
iptables -A OUTPUT -p tcp --dport 53 -j DROP
🧯 If You Can't Patch
- Audit applications for getnetbyaddr usage and modify to avoid zero-valued network queries
- Implement network monitoring for unusual DNS queries containing binary data
🔍 How to Verify
Check if Vulnerable:
Check glibc version with 'ldd --version' and verify nsswitch.conf contains 'networks: dns'Check Version:
ldd --version | head -1Verify Fix Applied:
Confirm glibc version is 2.43+ with 'ldd --version' and test getnetbyaddr functions📡 Detection & Monitoring
Log Indicators:
- DNS query logs showing unusual binary data in network resolution requests
Network Indicators:
- DNS queries for network resolution containing non-textual data patterns
SIEM Query:
dns.query: "*.in-addr.arpa" AND payload_size > 100