CVE-2023-31130: Buffer Underwrite in ares_inet_net_pton()
aresinetnetpton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via aressetsortlist().
CVE-2023-31130. Moderate. Buffer Underwrite in aresinetnetpton() (https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v)
Other sources
c-ares could provide weaker than expected security, caused by a buffer underflow in aresinetnetpton(). A remote attacker could exploit this vulnerability to launch further attacks on the system.
— IBM
c-ares is an asynchronous resolver library. aresinetnetpton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via aressetsortlist(). However, users may externally use aresinetnetpton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.14.0-1ubuntu0.2+ - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.10.0-3ubuntu0.2+ - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.19.1Fixed in 1.18.1-3 - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.15.0-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.18.1-1ubuntu0.22.04.2 - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.18.1-1ubuntu0.22.10.2 - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.18.1-2ubuntu0.1 - Upgrade
Upgrade
debian/c-aresto a version that resolves this vulnerability.Fixed in 1.14.0-1+deb10u4Fixed in 1.17.1-1+deb11u3Fixed in 1.18.1-3Fixed in 1.26.0-1 - Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.19.1 - Upgrade
Upgrade
debian/c-aresto a version that resolves this vulnerability.Fixed in 1.14.0-1+deb10u4 - Upgrade
Upgrade
debian/c-aresto a version that resolves this vulnerability.Fixed in 1.17.1-1+deb11u3 - Upgrade
Upgrade
debian/c-aresto a version that resolves this vulnerability.Fixed in 1.18.1-3 - Upgrade
Upgrade
debian/c-aresto a version that resolves this vulnerability.Fixed in 1.26.0-1 - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.19.1 - Upgrade
Upgrade
ubuntu/c-aresto a version that resolves this vulnerability.Fixed in 1.18.1-3 - Configuration
Do not configure the IPv6 address '0::00:00:00/2' (or other untrusted IPv6 sortlist entries) via ares_set_sortlist(); avoid adding untrusted values to sortlist.
c-ares (ares_set_sortlist) sortlist entries = avoid adding '0::00:00:00/2' or other untrusted IPv6 addresses - Configuration
Avoid calling ares_inet_net_pton() with untrusted or externally-supplied input; validate or sanitize IPv6 inputs before use.
c-ares (ares_inet_net_pton) usage on untrusted input = do not use on untrusted input - Operational
Inspect configurations and code for use of ares_set_sortlist() and ares_inet_net_pton(); remove or sanitize any entries like '0::00:00:00/2'. After remediation, apply the appropriate package updates listed above for your distribution.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-31130.
What is the severity level of CVE-2023-31130?
The severity level of CVE-2023-31130 is medium.
What is the affected software?
The affected software includes c-ares versions up to and including 1.19.1, Fedora 37 and 38, and various versions of Ubuntu and Debian packages.
What is the description of CVE-2023-31130?
CVE-2023-31130 is a vulnerability in c-ares library that allows a buffer underflow for certain IPv6 addresses.
How can I fix CVE-2023-31130?
To fix CVE-2023-31130, update to a version of c-ares that is not affected by this vulnerability.