CVE-2023-4806

What it actually does

Use-after-free in glibc getaddrinfo when an NSS module provides only _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks (no _nss_*_gethostbyname3_r), the resolved name returns many IPv4/IPv6 addresses, and the call uses AF_INET6 with AI_CANONNAME|AI_ALL|AI_V4MAPPED, resulting in access to freed memory and application crash.

Why it matters to the business

Applications performing DNS lookups under uncommon NSS configurations may experience unexpected crashes, leading to service disruption or degraded availability in environments relying on glibc for name resolution.

How an attack unfolds

An attacker triggers repeated getaddrinfo calls with the specific address family and flags against a system using a minimal NSS module implementation; the sequence of hook invocations causes the library to dereference freed memory, crashing the calling process and denying service.

How to fix it

Upgrade glibc to a version containing the fix for this use-after-free; monitor vendor advisories for Red Hat Enterprise Linux and Fedora packages and apply updates as they become available. Where immediate patching is not possible, restrict use of custom NSS modules that omit the _nss_*_gethostbyname3_r hook.

How to confirm the fix worked

After applying updates, recompile or redeploy affected applications and exercise getaddrinfo calls under the previously triggering conditions to confirm absence of crashes; review package versions against vendor security errata.

Typical attack path

1. Identify or influence a target application that performs DNS resolution via glibc getaddrinfo
2. Ensure the target environment uses an NSS module exposing only the two listed hooks without the third
3. Craft or trigger name resolution requests returning large numbers of IPv4 and IPv6 addresses
4. Invoke getaddrinfo with AF_INET6, AI_CANONNAME, AI_ALL, and AI_V4MAPPED flags
5. Observe process crash due to use-after-free

How to detect it

Review application and system logs for unexpected crashes or segmentation faults occurring during DNS resolution; correlate timestamps with getaddrinfo usage in processes that rely on glibc; examine NSS configuration files for modules implementing only the two listed hooks.

What your security team should do

• Prioritize patching glibc in internet-facing or high-availability systems that perform DNS lookups
• Audit NSS module configurations and remove or replace minimal hook implementations where feasible
• Monitor upstream glibc and distribution mailing lists for the availability of fixed packages
• Include glibc version checks in vulnerability scanning and asset inventory processes