Heap Buffer Over-Read in Zephyr RTOS DNS Resolver

Executive Summary

This vulnerability exists in Zephyr's DNS resolver when it processes mDNS (.local) queries. The resolver uses a fixed-length memory comparison (memcmp) of 7 bytes to check if a hostname ends with ".local". However, if the hostname's final label is shorter than 7 bytes (such as .org, .com, .net, .io, or a trailing dot), the memcmp reads 1-2 bytes beyond the string's null terminator.

Because the hostname is supplied by the caller and can be influenced by operators or remote inputs, this out-of-bounds read can cross the allocation boundary in tightly sized buffers. If this boundary is unmapped (for example, due to guard pages or memory protection units), the over-read causes a fault, leading to a denial of service.

Importantly, the over-read bytes are never returned, so there is no information disclosure. The issue only occurs when the CONFIG_MDNS_RESOLVER option is enabled and has been fixed by replacing the fixed-length memcmp with a null-safe strcmp.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to an out-of-bounds read in the Zephyr RTOS DNS resolver when processing mDNS (.local) queries. Detection involves identifying if your system is running a vulnerable version of Zephyr with CONFIG_MDNS_RESOLVER enabled and if it processes DNS queries with hostnames having final labels shorter than 7 bytes.

Since the vulnerability is triggered by specific DNS queries, you can monitor DNS traffic for queries ending with short suffixes like .org, .com, .net, .io, or a trailing dot, especially if they are processed by Zephyr's DNS resolver.

To detect the vulnerability on your system, check the Zephyr version and configuration:

• Verify if CONFIG_MDNS_RESOLVER is enabled in your Zephyr build configuration.
• Check the Zephyr version; versions from v1.10.0 up to before v4.5.0 are vulnerable.

For network detection, you can capture DNS queries and filter for those with short final labels using tools like tcpdump or tshark. Example commands:

• tcpdump -i <interface> -nn -s0 -v udp port 53 and 'udp[10:2] > 0'
• tshark -i <interface> -Y 'dns.qry.name matches "\.(org|com|net|io|)$"' -T fields -e dns.qry.name

Additionally, monitoring system logs or crash reports for faults related to DNS resolution may help detect exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) in systems using Zephyr's DNS resolver with the MDNS resolver enabled. Specifically, when processing certain hostnames with short final labels, the resolver may perform an out-of-bounds memory read that triggers a fault if it crosses an unmapped memory boundary.

Such a fault can crash or halt the affected process or system component, potentially disrupting network name resolution and related services.

There is no risk of information disclosure or privilege escalation from this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service due to a memory over-read in Zephyr's DNS resolver when resolving certain hostnames. It does not result in information disclosure or data leakage.

Since the flaw does not expose or leak sensitive data, it does not directly impact compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on confidentiality and privacy of personal data.

However, the denial of service could affect system availability, which may be a consideration under some regulatory frameworks that require maintaining service continuity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the Zephyr build does not enable CONFIG_MDNS_RESOLVER or update to a version where the fixed-length memcmp call is replaced with a NUL-safe strcmp(ptr, ".local"). This prevents the out-of-bounds read that causes denial of service.

Useful 0 Not Useful 0