CVE-2024-43167: Unbound: null pointer dereference in unbound
A NULL pointer dereference flaw was found in the ubctxsetfwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ubctxsetfwd and ubctxresolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.
Other sources
Unbound: null pointer dereference in unbound
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43167?
CVE-2024-43167 is considered a moderate severity vulnerability due to its potential to cause a segmentation fault.
What software is affected by CVE-2024-43167?
CVE-2024-43167 affects Unbound versions up to 1.13.1-1+deb11u2, 1.17.1-2+deb12u2, and 1.20.0-1.
How do I fix CVE-2024-43167?
To fix CVE-2024-43167, upgrade Unbound to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2024-43167?
CVE-2024-43167 is a NULL pointer dereference issue that can lead to application crashes.
What potential impact does CVE-2024-43167 have on security?
The impact of CVE-2024-43167 may include application downtime or denial of service due to the segmentation fault.