Use-after-free in c-ares - #VU156260

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by crashing an application using c-ares.

The vulnerability exists due to use-after-free in the c-ares lookup cancellation and channel destruction handling when application callbacks reconfigure servers or start a new lookup whose send fails. Cancelled lookups remain reachable through internal tracking during callback execution, allowing the same lookup to be completed twice. A remote attacker can trigger this condition in an affected application to cause access to freed memory and crash the process.

Affected software

Remediation

External References

• https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh
• https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae

Related Security Bulletins

• Multiple vulnerabilities in c-ares