REDHAT-BUG-2358271: Use After Free
c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in readanswers() when processanswer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but readanswers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2358271?
The severity of REDHAT-BUG-2358271 is categorized as high due to the potential for exploitation through a use-after-free vulnerability.
How do I fix REDHAT-BUG-2358271?
To fix REDHAT-BUG-2358271, you should update c-ares to versions beyond 1.34.4 or apply any patches provided by the vendor.
What software versions are affected by REDHAT-BUG-2358271?
REDHAT-BUG-2358271 affects c-ares versions from 1.32.3 through 1.34.4.
What is a use-after-free vulnerability in the context of REDHAT-BUG-2358271?
In the context of REDHAT-BUG-2358271, a use-after-free vulnerability allows an attacker to manipulate memory after it has been freed, potentially leading to remote code execution.
Are there any mitigation strategies for REDHAT-BUG-2358271?
Mitigation strategies for REDHAT-BUG-2358271 include limiting access to affected services and monitoring for unusual DNS query patterns until the vulnerability is resolved.