CVE-2024-43168: Unbound: heap-buffer-overflow in unbound
A heap-buffer-overflow flaw was found in the cfgmarkports function within Unbound's configfile.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.
Other sources
Unbound version <= 1.19.3 contains a heap-buffer-overflow vulnerability. The flaw occurs in the cfgmarkports function within the configfile.c file, leading to potential memory corruption. This issue can be triggered when processing certain inputs, causing the application to crash or potentially allowing an attacker to execute arbitrary code.
— Red Hat
Unbound: heap-buffer-overflow in unbound
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43168?
CVE-2024-43168 is considered a high severity vulnerability due to the potential for memory corruption and application crashes.
How do I fix CVE-2024-43168?
To fix CVE-2024-43168, update Unbound to version 1.20.0-1 or later.
What impacts does CVE-2024-43168 have on affected systems?
CVE-2024-43168 could lead to memory corruption and allow local attackers to crash the application.
Which software versions are affected by CVE-2024-43168?
Versions of Unbound up to 1.13.1-1+deb11u2 and 1.17.1-2+deb12u2 are affected by CVE-2024-43168.
Is CVE-2024-43168 remotely exploitable?
No, CVE-2024-43168 requires local access for exploitation.