Out-of-bounds write in c-ares - #VU156255

Vulnerability details

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to improper synchronization in c-ares ares_save_options(), also used by ares_dup(), when copying channel configuration while another thread changes it. A local user can trigger concurrent configuration changes and option copying to cause writes past a buffer sized for the previous server list or access settings freed during copying, resulting in memory corruption and a denial of service.

Affected software

Remediation

External References

• https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v
• https://github.com/c-ares/c-ares/commit/25a6911370878d4b617b44b142ea0e49d1ccede6

Related Security Bulletins

• Multiple vulnerabilities in c-ares