REDHAT-BUG-2209494: Low severity c-ares c-ares vulnerability
When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG.
CVE-2023-31124. Low. AutoTools does not set CARESRANDOMFILE during cross compilation (https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When cross-compiling c-ares with the autotools build system, explicitly set the CARES_RANDOM_FILE build-time variable to point to a cryptographically secure random source so the library does not fall back to rand().
c-ares (autotools cross-compile) CARES_RANDOM_FILE = path to a cryptographically secure random source - Operational
Rebuild any cross-compiled c-ares artifacts that may have been produced without CARES_RANDOM_FILE set, replacing binaries that could have used rand() fallback with builds that use a CSPRNG as configured above.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2209494?
The severity of REDHAT-BUG-2209494 is potentially high due to the use of a non-cryptographically secure random number generator.
How can I fix REDHAT-BUG-2209494?
To fix REDHAT-BUG-2209494, ensure that the cross-compilation includes a proper source of entropy for the CSPRNG.
What software is affected by REDHAT-BUG-2209494?
The c-ares library is affected by REDHAT-BUG-2209494 when cross-compiling for certain platforms.
What are the risks associated with REDHAT-BUG-2209494?
The risks associated with REDHAT-BUG-2209494 include potential exposure to predictability in random number generation, which could be exploited by attackers.
Is there a workaround for REDHAT-BUG-2209494?
A temporary workaround for REDHAT-BUG-2209494 involves configuring the build system to explicitly set CARES_RANDOM_FILE during cross-compilation.