Atlantic.Net Blog

What is: glibc (GNU C Library) Vulnerability (CVE-2015-7547) Patch and Information

Mason Moody
by Atlantic.Net (7 posts) under HIPAA Compliant Hosting

On Tuesday, 16 February 2016, Google security researchers Fermin J. Serna and Kevin Stadmeyer announced the discovery of a vulnerability in the GNU C library (called “glibc” or “libc6”, depending on the specific platform) that underlies many Unix/Linux systems. Similar to the GHOST vulnerability, exploitation of this vulnerability involves a buffer overflow that can cause a system crash or allow an attacker to remotely execute malicious code.

How It Works

When the Google researchers reported the vulnerability to the C library maintainers, they discovered that the bug had previously been reported in July 2015 (hence its 2015 CVE number). Red Hat researchers had been working quietly to understand the full extent of this issue, and they presumably, in conjunction with the Google researchers, waited until they had an effective patch in place before making their announcement public.

In short, this exploit leaves any Linux based cloud server that uses glibc and performs domain name lookups potentially vulnerable to attack. Specifically, the proof-of-concept the researchers have demonstrated employs specially crafted packets that cause the getaddrinfo() function to mishandle certain memory buffers, triggering a buffer overflow (a commonly used tactic among those who look for vulnerabilities to exploit). The publicly available proof-of-concept causes a server to crash; the researchers have withheld the proof-of-concept code that would allow for remote code execution.

Since so many server functions utilize the affected library–including sudo, curl, and ssh, to name a few–patching glibc is the safest path to protect your servers from this sort of exploit. While there is no evidence of this vulnerability being exploited in the wild, any server running version 2.9 or later of glibc should be updated to the patched version as soon as possible (if you are running a version of the C library older than 2.9, your best bet is still to upgrade to address any of the other known vulnerabilities that the intervening upgrades have patched).

How To Identify Your Version of glibc

You can identify your currently running version of the C library you are using on the command line with the following command:

ldd --version


Example of output from `ldd --version`

Example of output from `ldd –version`

Patched glibc Versions

Most repositories now have patched versions of the library available through their respective package managers, including the following (likely non-exhaustive) list:

  • CentOS 6: glibc-2.12-1.166.el6_7.7
  • CentOS 7: glibc-2.17-106.el7_2.4
  • Ubuntu 15.10: libc6 2.21-0ubuntu4.1
  • Ubuntu 14.04 LTS: libc6 2.19-0ubuntu6.7
  • Ubuntu 12.04 LTS: libc6 2.15-0ubuntu10.13
  • Debian 6: libc6 2.11.3-4+deb6u11
  • Debian 7: libc6 2.13-38+deb7u10
  • Debian 8: libc6 2.19-18+deb8u3
  • Debian Sid (unstable): libc6 2.21-8
  • Arch Linux: glibc-2.23-1

How To Update the glibc Vulnerability

The simplest way to update will be through your respective package managers.


sudo yum update glibc


sudo apt-get install libc6


sudo apt-get install libc6


sudo pacman -S "glibc>=2.23"

Once you install the updated version, you will need to restart each service that uses the C library to ensure they are using the patched version. Your safest bet is to schedule a reboot of your cloud server.

Update (2016-02-18): Edited the Debian package names to correct the name of the C library package from “eglibc” to “libc6”.

Update (2016-02-24): Added the patched glibc version for Arch Linux along with update instructions.

About Atlantic.Net

Atlantic.Net offers top-tier managed hosting services, including HIPAA-compliant cloud hosting.

Start Your HIPAA Project with a Free Fully Audited HIPAA Platform Trial!

HIPAA Compliant Compute & Storage, Encrypted VPN, Security Firewall, BAA, Offsite Backups, Disaster Recovery, & More!

Start My Free Trial

Looking for HIPAA Compliant Hosting?

We Can Help with a Free Assessment.

  • IT Architecture Design, Security, & Guidance.
  • Flexible Private, Public, & Hybrid Hosting.
  • 24x7x365 Security, Support, & Monitoring.
Contact Us Now!
Stevie Gold Award
Inc 500
Global Infosec 2021
28 Year logo
Ehla Badges 2021 Winner
Made In USA

SOC Audit HIPAA Audit HITECH Audit

Case Studies

White Papers


Recent Posts

Best Cloud Consultancy or MSP in 2022
BAA Red Flags: What Should Your HIPAA-Compliant Hosting Company Be Willing to Accommodate?
HIPAA Compliance for Remote Workers: How to Maintain HIPAA Compliance with a Remote Team
How to Make the Best Use of the Cloud in the Internet of Things (IoT)
How to Make the Best Use of Artificial Intelligence in Cloud Computing

Get started with 12 months of free cloud VPS hosting

Free Tier includes:
G3.2GB Cloud VPS Server Free to Use for One Year
50 GB of Block Storage Free to Use for One Year
50 GB of Snapshots Free to Use for One Year

New York, NY

100 Delawanna Ave, Suite 1

Clifton, NJ 07014

United States

San Francisco, CA

2820 Northwestern Pkwy,

Santa Clara, CA 95051

United States

Dallas, TX

2008 Lookout Dr,

Garland, Texas 75044

United States

Ashburn, VA

1807 Michael Faraday Ct,

Reston, VA 20190

United States

Orlando, FL

440 W Kennedy Blvd, Suite 3

Orlando, FL 32810

United States

Toronto, Canada

20 Pullman Ct, Scarborough,

Ontario M1X 1E4


London, UK

14 Liverpool Road, Slough,

Berkshire SL1 4QZ

United Kingdom