CVE-2013-7423

What it actually does

The send_dg function in resolv/res_send.c fails to properly reuse file descriptors, allowing repeated getaddrinfo calls to cause DNS queries to be sent to unintended destinations.

Why it matters to the business

Systems may experience misdirected DNS resolutions that could enable attackers to influence or observe name resolution traffic, increasing risk of data exposure or service disruption on unpatched Linux environments.

How an attack unfolds

An attacker generates a high volume of requests that invoke getaddrinfo on a vulnerable system, triggering the flawed send_dg logic to emit DNS queries toward attacker-chosen or unintended resolvers.

How to fix it

Upgrade the GNU C Library to version 2.20 or later on all affected distributions; apply vendor patches for Red Hat Enterprise Linux, Ubuntu, and openSUSE as soon as available.

How to confirm the fix worked

Confirm glibc version is 2.20 or newer via package manager or ldd --version; test resolver behavior under load to verify file descriptor reuse; review vendor security advisories for backported fixes.

Typical attack path

1. Identify or reach a system using an affected glibc version
2. Issue repeated getaddrinfo or related resolver calls at high volume
3. Observe or intercept the resulting misdirected DNS queries
4. Leverage the unintended resolver interaction for further reconnaissance or traffic manipulation

How to detect it

Examine DNS query logs and resolver activity for patterns of repeated getaddrinfo calls resulting in unexpected destination addresses; review historical system call traces or strace output for file descriptor handling anomalies around DNS operations.

What your security team should do

• Prioritize patching glibc across all Linux servers and containers due to the age of the flaw and broad ecosystem exposure
• Monitor for any remaining systems running glibc versions prior to 2.20
• Review DNS resolution logging for anomalies that could indicate misdirected queries
• Apply compensating controls such as strict network egress filtering for DNS traffic until patches are deployed