CVE-2023-31137
Summary
| CVE | CVE-2023-31137 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-05-09 14:15:00 UTC |
| Updated | 2023-06-29 12:15:00 UTC |
| Description | MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58. |
Risk And Classification
Problem Types: CWE-191
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 38 Update: maradns-3.5.0036-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: maradns-3.5.0036-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| Integer Underflow Vulnerability in DNS Packet Decompression · Advisory · samboy/MaraDNS · GitHub | MISC | github.com | |
| Fix long standing issue in this code from 2002 · samboy/MaraDNS@bab062b · GitHub | MISC | github.com | |
| MaraDNS/Decompress.c at 08b21ea20d80cedcb74aa8f14979ec7c61846663 · samboy/MaraDNS · GitHub | MISC | github.com | |
| Debian -- Security Information -- DSA-5441-1 maradns | MISC | www.debian.org | |
| [SECURITY] [DLA 3457-1] maradns security update | MISC | lists.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181878 Debian Security Update for maradns (DLA 3457-1)
- 199635 Ubuntu Security Notification for Mara Domain Name System (DNS) Vulnerabilities (USN-6271-1)
- 283996 Fedora Security Update for maradns (FEDORA-2023-cdce244fb8)
- 284134 Fedora Security Update for maradns (FEDORA-2023-0c012f6245)
- 285314 Fedora Security Update for maradns (FEDORA-2023-3dd938a14d)
- 6000241 Debian Security Update for maradns (DSA 5441-1)