CVE-2026-4438 GNU C Library DNS主机名验证绕过漏洞

#include <stdio.h> #include <netdb.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> // PoC for CVE-2026-4438: glibc gethostbyaddr invalid hostname // This code demonstrates the vulnerable function call. // Requires an environment where nsswitch.conf uses DNS backend // and a malicious DNS server responds to the target IP. int main() { struct hostent *he; struct in_addr addr; // Target IP address (e.g., local network IP) inet_aton("192.168.1.100", &addr); // Vulnerable function call he = gethostbyaddr(&addr, sizeof(addr), AF_INET); if (he == NULL) { herror("gethostbyaddr"); return 1; } // Output the potentially invalid hostname printf("Official name: %s\n", he->h_name); return 0; }