CVE-2023-31130 — Buffer Underflow in C-ares

CWE-124 — Buffer UnderflowCWE-787 — Out-of-bounds Write10 documents7 sources
Severity
6.4MEDIUMNVD
CNA4.1
EPSS
0.0%
top 98.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
C-aresC-ares Project C-aresDebian Linux+1 more
Timeline
PublishedMay 25
Latest updateSep 11

Description

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.1…

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.5 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5c-ares/c-ares< 1.19.1
▶NVDc-ares_project/c-ares< 1.19.1
▶Debianc-ares/c-ares< 1.17.1-1+deb11u3+3
▶Ubuntuc-ares/c-ares< 1.15.0-1ubuntu0.3+3

Also affects: Debian Linux 10.0, 11.0, Fedora 37, 38

🔴Vulnerability Details

4
OSV
c-ares vulnerabilities↗2023-09-11
▶
OSV
c-ares vulnerabilities↗2023-06-14
▶
OSV
CVE-2023-31130: c-ares is an asynchronous resolver library↗2023-05-25
▶
CVEList
Buffer Underwrite in ares_inet_net_pton()↗2023-05-25
▶

📋Vendor Advisories

5
Ubuntu
c-ares vulnerabilities↗2023-09-11
▶
Ubuntu
c-ares vulnerabilities↗2023-06-14
▶
Red Hat
c-ares: Buffer Underwrite in ares_inet_net_pton()↗2023-05-22
▶
Microsoft
Buffer Underwrite in ares_inet_net_pton()↗2023-05-09
▶
Debian
CVE-2023-31130: c-ares - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable t...↗2023
▶
CVE-2023-31130 — Buffer Underflow in C-ares | cvebase