CVE-2022-23097

Reference Links

• https://git.kernel.org/pub/scm/network/connman/connman.git/log/
• https://www.openwall.com/lists/oss-security/2022/01/25/1
• https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html
• https://www.debian.org/security/2022/dsa-5231
• https://security.gentoo.org/glsa/202310-21
• https://launchpad.net/bugs/cve/CVE-2022-23097
• https://lore.kernel.org/connman/20220125090026.5108-1-wagi@monom.org/
• https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=e5a313736e13c90d19085e953a26256a198e4950
• https://security-tracker.debian.org/tracker/CVE-2022-23097
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23097
• https://ubuntu.com/security/notices/USN-6236-1
• https://nvd.nist.gov/vuln/detail/CVE-2022-23097
• https://ubuntu.com/security/CVE-2022-23097

Parent vulnerabilities

(Appears in the following advisories)

• USN-6236-1

Frequently Asked Questions

• What is CVE-2022-23097?

  CVE-2022-23097 is an issue discovered in the DNS proxy in Connman through 1.40, where forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read.

• How does CVE-2022-23097 impact Connman?

  CVE-2022-23097 could allow an attacker to cause an out-of-bounds read in the DNS proxy of Connman, potentially leading to information disclosure or denial of service.

• Which versions of Connman are affected by CVE-2022-23097?

  Connman versions 1.36-2.1~deb10u5, 1.36-2.2+deb11u1, 1.36-2.2+deb11u2, and 1.41-3 are affected by CVE-2022-23097.

• How can I fix CVE-2022-23097?

  To fix CVE-2022-23097, upgrade to Connman version 1.36-2.3ubuntu0.1 or higher, or apply the appropriate security patch provided by your Linux distribution.

• Where can I find more information about CVE-2022-23097?

  You can find more information about CVE-2022-23097 on the Git repository of Connman and the advisory links provided.