CVE-2023-31137
published 2023-05-09CVE-2023-31137: MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.14%
63.1th percentile
MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.
The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.
One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | maradns | < maradns 2.0.13-1.4+deb11u1 (bullseye) | maradns 2.0.13-1.4+deb11u1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| maradns | maradns | < 3.4.10 | 3.4.10 |
| maradns | maradns | >= 0 < 2.0.13-1.4+deb11u1 | 2.0.13-1.4+deb11u1 |
| maradns | maradns | >= 0 < 2.0.13-1.4+deb11u1build0.20.04.1 | 2.0.13-1.4+deb11u1build0.20.04.1 |
| maradns | maradns | >= 0 < 2.0.13-1.4+deb11u1build0.22.04.1 | 2.0.13-1.4+deb11u1build0.22.04.1 |
| maradns | maradns | >= 0 < 2.0.13-1ubuntu0.1~esm1 | 2.0.13-1ubuntu0.1~esm1 |
| maradns | maradns | >= 0 < 2.0.13-1.2ubuntu0.1~esm1 | 2.0.13-1.2ubuntu0.1~esm1 |
| maradns | maradns | >= 3.5.0001 < 3.5.0036 | 3.5.0036 |
| samboy | maradns | <= 3.5.0024 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
MaraDNS vulnerabilities
vendor_ubuntu·2023-08-03·CVSS 7.5
CVE-2023-31137 [HIGH] MaraDNS vulnerabilities
Title: MaraDNS vulnerabilities
Summary: Several security issues were fixed in MaraDNS.
Xiang Li discovered that MaraDNS incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2022-30256)
Huascar Tejeda discovered that MaraDNS incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. (CVE-2023-31137)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2023-31137: maradns - MaraDNS is open-source software that implements the Domain Name System (DNS). In...
vendor_debian·2023·CVSS 7.5
CVE-2023-31137 [HIGH] CVE-2023-31137: maradns - MaraDNS is open-source software that implements the Domain Name System (DNS). In...
MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to alloca
OSV
maradns vulnerabilities
osv·2023-08-03·CVSS 7.5
CVE-2022-30256 [HIGH] maradns vulnerabilities
maradns vulnerabilities
Xiang Li discovered that MaraDNS incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2022-30256)
Huascar Tejeda discovered that MaraDNS incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. (CVE-2023-31137)
OSV
CVE-2023-31137: MaraDNS is open-source software that implements the Domain Name System (DNS)
osv·2023-05-09·CVSS 7.5
CVE-2023-31137 [HIGH] CVE-2023-31137: MaraDNS is open-source software that implements the Domain Name System (DNS)
MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to alloca
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/samboy/MaraDNS/blob/08b21ea20d80cedcb74aa8f14979ec7c61846663/dns/Decompress.c#L886https://github.com/samboy/MaraDNS/commit/bab062bde40b2ae8a91eecd522e84d8b993bab58https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3chttps://lists.debian.org/debian-lts-announce/2023/06/msg00019.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL/https://lists.fedoraproject.org/archives/list/[email protected]/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/https://www.debian.org/security/2023/dsa-5441https://github.com/samboy/MaraDNS/blob/08b21ea20d80cedcb74aa8f14979ec7c61846663/dns/Decompress.c#L886https://github.com/samboy/MaraDNS/commit/bab062bde40b2ae8a91eecd522e84d8b993bab58https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3chttps://lists.debian.org/debian-lts-announce/2023/06/msg00019.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL/https://lists.fedoraproject.org/archives/list/[email protected]/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/https://www.debian.org/security/2023/dsa-5441
2023-05-09
Published