| 제목 | The Trusted Domain Project OpenDKIM 2.11.0 Out-of-bounds Write |
|---|
| 설명 | OpenDKIM contains an out-of-bounds write in its DKIM signature header-selection logic. A crafted `h=` field that references more matching headers than are present in the message can cause the verification library to write past the end of an allocated array.
The issue is triggered while processing an inbound DKIM-signed message before cryptographic verification, so a valid signature or authentication is not required. A remote attacker may exploit the flaw to corrupt memory and crash the mail-filtering process, resulting in denial of service. Code execution has not been demonstrated.
`dkim_canon_selecthdrs()` allocates space based on the number of headers present in the message, but iterates over the header names listed in the attacker-controlled `h=` field. It writes an entry before verifying that sufficient space remains, allowing a pointer-sized write one element beyond the allocated array. The existing bounds check occurs only after the loop. |
|---|
| 원천 | ⚠️ https://weitongli.com/share/opendkim-h-tag-oob-write.html |
|---|
| 사용자 | WeitongLi (UID 100239) |
|---|
| 제출 | 2026. 08. 06. AM 09:07 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. AM 09:36 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 410837 [Trusted Domain Project OpenDKIM 까지 2.11.0 DKIM Signature Header Selection libopendkim/dkim-canon.c dkim_canon_selecthdrs h 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|