Junglewise Threat Intelligence

CVE-2021-23386: mafintosh dns-packet memory exposure via uninitialized buffers

CVE-2021-23386 · Severity: low · CVSS 3.1 · Published 2021-05-24

Executive brief

A vulnerability in the dns-packet library, used for processing DNS network traffic, could allow an attacker to view sensitive information stored in a server's memory. By sending specially crafted domain name queries, an attacker can trick the system into sending back uninitialized data, potentially exposing passwords, encryption keys, or other private data. This could lead to a significant breach of confidentiality for applications using this component.

Technical details

The dns-packet library before versions 1.3.2 and 5.2.2 utilizes Node.js 'Buffer.allocUnsafe()' to create buffers for network packets. Because 'allocUnsafe' does not zero-fill the allocated memory, and the library fails to fully populate these buffers before transmission in certain edge cases (specifically when handling crafted invalid domain names), residual data from previous memory allocations is leaked. An attacker with the ability to trigger DNS queries can exploit this to perform remote memory disclosure. The issue was addressed by ensuring proper length calculations and trimming during the encoding process.

Affected products

  • mafintosh dns-packet < 1.3.2, >= 2.0.0 < 5.2.2

Timeline

  • 2021-05-18: disclosed: Vulnerability disclosed via HackerOne.
  • 2021-05-20: advisory: NVD and Snyk published advisories.
  • 2021-05-24: advisory: GitHub Advisory published.

References