In the GNU C Library (aka glibc or libc6) through 2.28 attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

GNU libc up to version 2.28 leaves an open socket when resolving a crafted hostname with getaddrinfo via if nametoindex.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in GNU C Library affects IBM Watson Studio Local	20 Dec 201913:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Proventia Network Active Bypass is affected by glibc vulnerabilities (CVE-2018-19591)	27 Mar 201906:55	–	ibm
ALT Linux	Security fix for the ALT Linux 9 package glibc version 6:2.27-alt7	27 Nov 201800:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : glibc (ALAS-2019-1140)	10 Jan 201900:00	–	nessus
Tenable Nessus	Fedora 28 : glibc (2018-060302dc83)	3 Jan 201900:00	–	nessus
Tenable Nessus	Fedora 29 : glibc (2018-f6b7df660d)	3 Jan 201900:00	–	nessus
Tenable Nessus	GLSA-201903-09 : GNU C Library: Arbitrary descriptor allocation	14 Mar 201900:00	–	nessus
Tenable Nessus	GLSA-201908-06 : glibc: Multiple vulnerabilities	20 Aug 201900:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0053)	10 Mar 202100:00	–	nessus

Vulners

Node

18 Aug 2020 07:00Current

7.8High risk

Vulners AI Score7.8

CVSS 25

CVSS 37.5

CVSS 3.17.5

EPSS0.01775

SSVC