CVE-2025-32366
- Source
- https://cve.org/CVERecord?id=CVE-2025-32366
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-32366.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-32366
- Downstream
- Withdrawn
- 2026-01-27T04:19:59.727778Z
- Published
- 2025-04-05T23:15:40Z
- Modified
- 2026-01-27T04:19:59.727778Z
- Summary
- [none]
- Details
-
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., rdlen=ntohs(rr->rdlen) and memcpy(response+offset,end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be larger than the amount of remaining packet data in the current state of parsing. Values of stack memory locations may be sent over the network in a response.
- References
-
- https://lapis-sawfish-be3.notion.site/0-day-Comman-memory-Leak-190dc00d01d080688472d322c93c4340
- https://web.archive.org/web/20250410130356/https://lapis-sawfish-be3.notion.site/0-day-Comman-memory-Leak-190dc00d01d080688472d322c93c4340
- https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1001
- https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n988