CVE-2024-25629 c-ares out of bounds read in ares__read_line()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-25629?
CVE-2024-25629 is a medium-severity vulnerability in Fedoraproject Fedora, published on 23 Feb 2024.
Official description
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
Which versions are affected by CVE-2024-25629?
It affects 2 products.
Linux distribution packages (31)
c-ares AlmaLinux:8 | All versions | 1.13.0-11.el8_10 |
c-ares-devel AlmaLinux:8 | All versions | 1.13.0-11.el8_10 |
c-ares AlmaLinux:9 | All versions | 1.19.1-2.el9_4 |
c-ares-devel AlmaLinux:9 | All versions | 1.19.1-2.el9_4 |
c-ares Red Hat:enterprise_linux:8::baseos | All versions | 0:1.13.0-11.el8_10 |
c-ares-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.13.0-11.el8_10 |
c-ares-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.13.0-11.el8_10 |
c-ares-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:1.13.0-11.el8_10 |
c-ares-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.19.1-2.el9_4 |
c-ares-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.19.1-2.el9_4 |
c-ares-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:1.19.1-2.el9_4 |
c-ares Red Hat:enterprise_linux:9::baseos | All versions | 0:1.19.1-2.el9_4 |
c-ares-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.19.1-2.el9_4 |
c-ares-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:1.19.1-2.el9_4 |
c-ares Rocky Linux:8 | All versions | 0:1.13.0-11.el8_10 |
c-ares Rocky Linux:9 | All versions | 0:1.19.1-2.el9_4 |
c-ares SUSE:Linux Enterprise Micro 5.1 | All versions | 1.19.1-150000.3.26.1 |
c-ares SUSE:Linux Enterprise Micro 5.2 | All versions | 1.19.1-150000.3.26.1 |
c-ares SUSE:Linux Enterprise Micro 5.3 | All versions | 1.19.1-150000.3.26.1 |
c-ares SUSE:Linux Enterprise Micro 5.4 | All versions | 1.19.1-150000.3.26.1 |
c-ares SUSE:Linux Enterprise Micro 5.5 | All versions | 1.19.1-150000.3.26.1 |
c-ares SUSE:Linux Enterprise Micro 5.5 | All versions | 1.19.1-150000.3.26.1 |
c-ares SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.19.1-150000.3.26.1 |
libcares2 SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.9.1-9.21.1 |
libcares2 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.9.1-9.21.1 |
libcares2 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.9.1-9.21.1 |
libcares2 SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 1.9.1-9.21.1 |
c-ares openSUSE:Leap 15.5 | All versions | 1.19.1-150000.3.26.1 |
c-ares openSUSE:Leap Micro 5.3 | All versions | 1.19.1-150000.3.26.1 |
c-ares openSUSE:Leap Micro 5.4 | All versions | 1.19.1-150000.3.26.1 |
c-ares openSUSE:Tumbleweed | All versions | 1.27.0-1.1 |
Products include C-Ares C-Ares, Fedoraproject Fedora.
How do I fix CVE-2024-25629?
Upgrade to a fixed version.
Is CVE-2024-25629 being exploited?
There is no known exploitation of CVE-2024-25629 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2024-25629, ALSA-2024:3842, ALSA-2024:4249, AZL-34453, AZL-34455, AZL-34456 and 29 more.