Siddhesh Poyarekar

تتعلق المشكلة باحتمال تعطل عميل `nscd` عند استدعاء وظائف مدعومة بنظام Name Service Switch (NSS) والتي تدعم التخزين المؤقت عبر `nscd` في ظل أحمال عالية على أنظمة x86 64. يستخدم عميل `nscd` في مكتبة GNU C الدالة `memcmp` مع مدخلات قد يتم تعديلها في الوقت نفسه بواسطة مؤشر ترابط آخر. قد يتعطل التنفيذ المُحسّن لدالة `memcmp` الذي تم إدخاله في الإصدار 2.36 من مكتبة GNU C لنظام x86 64 عند استدعائه مع مثل هذا السلوك غير المحدد، مما يؤدي إلى تعطل محتمل لعميل `nscd` والتطبيق الذي يستخدمه. تم ترحيل هذا التنفيذ إلى الفرع 2.35، مما يجعله عرضة للثغرة أيضًا. تنبع المشكلة من استخدام دالة `memcmp` على بيانات يتم تعديلها بشكل متزامن، مما قد يؤدي إلى حالات فقدان ذاكرة التخزين المؤقت الزائفة أو، في حالة التنفيذ المُحسّن، إلى تعطل النظام.

A flaw was found in glibc, where the `getaddrinfo` function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the ` nss * gethostbyname2 r` and ` nss * getcanonname r` hooks without implementing the ` nss * gethostbyname3 r` hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the `getaddrinfo` function should have the `AF INET6` address family with `AI CANONNAME`, `AI ALL`, and `AI V4MAPPED` as flags.

A flaw was found in the realpath() function of glibc, which can mistakenly return an unexpected value. This issue is related to memory release errors and can potentially lead to information leakage and disclosure of sensitive data. Exploitation of this flaw may allow a remote attacker to access confidential information.

The nameserver caching daemon (nscd) in the GNU C Library, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This issue is related to the `netgroupcache.c` component.

A flaw was found in glibc, specifically an off-by-one buffer overflow and underflow in the `getcwd()` function, which may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to `getcwd()` in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

The issue is a stack-based buffer overflow in the `getaddrinfo` function, which can be triggered by a hostname or IP address that results in a large number of AF INET6 address results, allowing remote attackers to cause a denial of service (crash). This problem exists due to an incomplete fix for a previous issue.

The issue allows context-dependent attackers to cause a denial of service, specifically an out-of-bounds read, when converting IBM930 encoded data to UTF-8 using the iconv function. This occurs when a multibyte character value of `0xffff` is provided.