CVE-2024-25629

c-ares is a C library for asynchronous DNS requests. ares__read_line() is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files has an embedded NULL character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/cc431b3424123d84bcd7afd4de150b33f117a8ef/cves/2024/25xxx/CVE-2024-25629.json",
    "cwe_ids": [
        "CWE-127"
    ]
}

References

Affected packages

Git / github.com/c-ares/c-ares

Affected ranges

Type: GIT
Repo: https://github.com/c-ares/c-ares
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9eb57f2c8beb4e8af590992e56182c0788b9ce0b