Vulnerability Details : CVE-2024-25629
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
Products affected by CVE-2024-25629
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
- cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2024-25629
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 9 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-25629
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST | 2025-02-05 |
|
4.4
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
0.8
|
3.6
|
GitHub, Inc. | 2024-02-23 |
|
4.4
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
N/A
|
N/A
|
RedHat-CVE-2024-25629 | 2024-02-23 |
CWE ids for CVE-2024-25629
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
-
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2024-25629
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX37LFPFQ3T6FFMMFYQTEGIQXXN7F27U/
[SECURITY] Fedora 39 Update: c-ares-1.28.1-1.fc39 - package-announce - Fedora Mailing-ListsMailing List
-
https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183
Merge pull request from GHSA-mg26-v6qh-x48q · c-ares/c-ares@a804c04 · GitHubPatch
-
https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
Out of bounds read in ares__read_line() · Advisory · c-ares/c-ares · GitHubVendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P76QYINQNPEHUTEEDOUYIRZ2X6UVZ5K/
[SECURITY] Fedora 38 Update: c-ares-1.28.1-1.fc38 - package-announce - Fedora Mailing-ListsMailing List
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSCMTSPDIE2UHU34TIXQQHZ6JTE3Y3VF/
[SECURITY] Fedora 40 Update: c-ares-1.28.1-1.fc40 - package-announce - Fedora Mailing-ListsMailing List
Jump to