Buffer overflow in musl libc - CVE-2017-15650
Published: April 27, 2020
Vulnerability identifier: #VU27338
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-15650
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: GNU
Affected software:
musl libc
musl libc
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary when processing DNS replies in dns_parse_callback(0 function in network/lookup_name.c. A remote attacker can send an unexpected number by sending A records in a reply to an AAAA query, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2017-15650
Install update from vendor's website.