Use of uninitialized resource in c-ares - #VU156254

Vulnerability details

The vulnerability allows a remote attacker to potentially disclose sensitive information and cause applications to use incorrect network addresses.

The vulnerability exists due to use of uninitialized stack memory in c-ares when parsing numeric IPv6 names containing a prefix length. A remote attacker can supply a crafted name such as ::1/0 to cause ares_inet_pton() to report success after initializing only the bytes covered by the prefix, allowing ares_getaddrinfo() or ares_gethostbyname() to return an address containing uninitialized stack data.

The crafted names cannot originate from a DNS reply.

Affected software

Remediation

External References

• https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r
• https://github.com/c-ares/c-ares/commit/7e65b381c0b915aa5671ddc713080c87e15fc42f

Related Security Bulletins

• Multiple vulnerabilities in c-ares