A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
The product calls free() twice on the same memory address.
| Link | Tags |
|---|---|
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/ | vendor advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1866838 | issue tracking patch exploit third party advisory |
| https://packetstormsecurity.com/files/158755/GS20200804145053.txt | exploit vdb entry third party advisory |
| https://c-ares.haxx.se/changelog.html | release notes vendor advisory |
| https://github.com/c-ares/c-ares/commit/1cc7e83c3bdfaafbc5919c95025592d8de3a170e | third party advisory patch |