#VU53543 Off-by-one in nginx - CVE-2021-23017

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error within the ngx_resolver_copy() function when processing DNS responses. A remote attacker can trigger an off-by-one error, write a dot character (‘.’, 0x2E) out of bounds in a heap allocated buffer and execute arbitrary code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

The vulnerability can be triggered by a DNS response in reply to a DNS request from nginx when the resolver primitive is configured. A specially crafted packet allows overwriting the least significant byte of next heap chunk metadata with 0x2E.

Remediation

External links

• https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
• https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html