DNS Response Parsing Buffer Overflow in Zephyr RTOS

Executive Summary

This vulnerability exists in Zephyr RTOS's DNS resolver, specifically in the dns_unpack_answer() function. The function only validates the fixed resource record (RR) header fields but does not verify if the declared resource data length (rdlength) extends beyond the actual size of the received DNS message. As a result, when processing TXT and SRV DNS records, the resolver may read beyond the valid buffer boundaries, causing an out-of-bounds read.

An attacker, such as a malicious DNS server or an on-path attacker forging DNS replies, can craft truncated or malformed DNS responses that exploit this lack of validation. This leads to the leakage of adjacent memory contents (stale or uninitialized data) to the application, which is an information disclosure. In some cases, this can also cause a denial of service if the read crosses allocation boundaries and faults.

The vulnerability affects Zephyr versions 4.3.0 and 4.4.0 and has been fixed by adding a check in dns_unpack_answer() to reject any resource record whose declared data length exceeds the actual DNS message size.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you primarily by causing information disclosure and potentially denial of service.

• Information Disclosure: The out-of-bounds read can leak residual or uninitialized memory contents from the DNS resolver's receive buffer to the application, exposing sensitive or stale data.
• Denial of Service: In some configurations, the out-of-bounds read may cross allocation boundaries and cause a fault, crashing the DNS resolver and leading to denial of service.

The vulnerability can be exploited remotely by a malicious or spoofed DNS server, an on-path attacker forging UDP DNS replies, or any LAN node if mDNS/LLMNR is enabled.

The CVSS base score is 4.8 (Medium), indicating a moderate severity with the primary impact on confidentiality and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malformed or truncated DNS responses with resource record (RR) data length fields (rdlength) that extend beyond the actual DNS message size, causing out-of-bounds reads.

To detect this on your network or system, you can monitor DNS traffic for suspicious or malformed TXT or SRV DNS responses where the rdlength field is larger than the actual packet size.

Suggested commands include using packet capture tools like tcpdump or Wireshark to capture DNS UDP traffic and then inspecting DNS response packets for inconsistencies in the rdlength field.

• Capture DNS traffic on port 53 using tcpdump: tcpdump -i <interface> udp port 53 -w dns_traffic.pcap
• Analyze captured packets in Wireshark and filter for DNS responses with TXT or SRV records.
• Look for DNS responses where the rdlength field in resource records exceeds the actual DNS message size or appears truncated.

Additionally, monitoring application logs for unusual DNS resolution errors or crashes related to DNS TXT or SRV records may help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update the Zephyr RTOS DNS resolver to a version that includes the patch fixing this vulnerability.

The patch adds validation in the dns_unpack_answer() function to reject any DNS resource record whose declared rdata length extends beyond the actual DNS message size, preventing out-of-bounds reads.

Until the update can be applied, consider disabling or restricting the use of DNS TXT and SRV record resolution if possible, especially from untrusted or external DNS servers.

Also, monitor DNS traffic for suspicious or malformed responses and implement network-level protections such as DNS response validation or DNSSEC to reduce the risk of spoofed or malicious DNS replies.

Useful 0 Not Useful 0