CVE-2015-5180

What it actually does

Remote attackers can trigger a NULL pointer dereference in the res_query function of libresolv, causing the affected process to crash.

Why it matters to the business

Applications relying on the vulnerable library may experience unexpected crashes, leading to service interruptions and potential loss of availability for monitoring or other services; the package has been fixed in a recent release reducing exposure in current deployments.

How an attack unfolds

An attacker sends a specially crafted DNS query or response over the network that reaches the res_query function in libresolv, triggering the NULL pointer dereference and crashing the process without authentication.

How to fix it

Upgrade prometheus-node-exporter-fips (Chainguard) to version 1.8.1-r2 or later to resolve the libresolv issue.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 1.8.1-r2, review changelogs for the glibc fix, and test DNS resolution paths under load to ensure no crashes occur.

Typical attack path

1. Locate services or hosts performing DNS resolution via the vulnerable glibc version
2. Craft and transmit a malicious DNS packet targeting res_query
3. Trigger the NULL dereference to crash the process and sustain denial of service

How to detect it

Review system and application logs for glibc or libresolv crashes during DNS operations; correlate with network traffic involving unexpected DNS queries.

What your security team should do

• Apply the fixed version 1.8.1-r2 immediately on all instances of the affected package
• Scan environments for any remaining vulnerable glibc deployments
• Monitor process logs for segmentation faults or DNS-related crashes as a temporary detection measure