MaraDNS up to 3.5.0024 DNS Packet Decompress.c decomp_get_rddata integer underflow

Summaryinfo

A vulnerability labeled as problematic has been found in MaraDNS up to 3.5.0024. Impacted is the function decomp_get_rddata of the file Decompress.c of the component DNS Packet Handler. The manipulation results in integer underflow. This vulnerability is known as CVE-2023-31137. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in MaraDNS up to 3.5.0024. Affected is the function decomp_get_rddata of the file Decompress.c of the component DNS Packet Handler. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on availability. CVE summarizes:

MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.

The weakness was published 05/09/2023. This vulnerability is traded as CVE-2023-31137 since 04/24/2023. There are known technical details, but no exploit is available.

Upgrading to version 3.5.0036 eliminates this vulnerability. Applying the patch bab062bde40b2ae8a91eecd522e84d8b993bab58 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• MaraDNS

Version

• 3.5.0024

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion