ConnMan up to 1.44 DNS Response dnsproxy.c ns_resolv lookup error condition

Summaryinfo

A vulnerability was found in ConnMan up to 1.44 and classified as problematic. Affected by this vulnerability is the function ns_resolv of the file dnsproxy.c of the component DNS Response Handler. The manipulation of the argument lookup results in error condition. This vulnerability is reported as CVE-2025-32743. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ConnMan up to 1.44. Affected is the function ns_resolv of the file dnsproxy.c of the component DNS Response Handler. The manipulation of the argument lookup with an unknown input leads to a error condition vulnerability. CWE is classifying the issue as CWE-392. The product encounters an error but does not provide a status code or return value to indicate that an error has occurred. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations.

The advisory is shared for download at web.git.kernel.org. This vulnerability is traded as CVE-2025-32743 since 04/10/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at web.git.kernel.org.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• ConnMan

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion