CVE-2021-23017: High severity F5 Nginx vulnerability
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
An off-by-one error in ngxresolvercopy() while processing DNS responses allows a network attacker to write a dot character ('.', 0x2E) out of bounds in a heap allocated buffer. The vulnerability can be triggered by a DNS response in reply to a DNS request from nginx when the resolver primitive is configured. A specially crafted packet allows overwriting the least significant byte of next heap chunk metadata with 0x2E. A network attacker capable of providing DNS responses to a nginx server can likely achieve remote code execution.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this security issue in nginx resolver?
The vulnerability ID for this security issue in nginx resolver is CVE-2021-23017.
What is the severity of CVE-2021-23017?
The severity of CVE-2021-23017 is high with a CVSS score of 8.1.
How does the vulnerability in nginx resolver occur?
The vulnerability in nginx resolver is caused by an off-by-one error while processing DNS responses.
What is the potential impact of this vulnerability?
The potential impact of this vulnerability is remote code execution.
How can I fix the vulnerability in nginx resolver?
To fix the vulnerability in nginx resolver, update to version 1.21.0 or 1.20.1 of nginx.