REDHAT-BUG-2209501: Medium severity c-ares c-ares vulnerability
Description of issue(s): When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available.
CVE-2023-31147 Insufficient randomness in generation of DNS query IDs (https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure a cryptographically secure RNG is available to c-ares: provide /dev/urandom on Unix-like systems or make RtlGenRandom() available on Windows so c-ares will not fall back to rand(). For containerized or minimal environments, include /dev/urandom or appropriate OS RNG support in the runtime image or host configuration.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2209501?
The severity of REDHAT-BUG-2209501 is considered high due to the predictability of DNS query IDs that may lead to security vulnerabilities.
How do I fix REDHAT-BUG-2209501?
To fix REDHAT-BUG-2209501, update to a patched version of c-ares that uses a secure random number generator.
What are the potential risks associated with REDHAT-BUG-2209501?
The potential risks include exposure to DNS spoofing attacks due to predictable random number generation.
Which versions of c-ares are affected by REDHAT-BUG-2209501?
All versions of c-ares that rely on the rand() function for generating DNS query IDs are affected by REDHAT-BUG-2209501.
Is there a workaround for REDHAT-BUG-2209501?
There are no effective workarounds for REDHAT-BUG-2209501 aside from upgrading to a secure version of c-ares.