Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2024-43167
2.8 LOW
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 6 months ago
Unbound: null pointer dereference in unbound

A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.

References

Affected products

rhcos
unbound
openstack-unbound-container
rhosp-rhel9/openstack-unbound
rhosp-rhel8-tech-preview/openstack-unbound

Matching in nixpkgs

pkgs.unbound

Validating, recursive, and caching DNS resolver

  • nixos-unstable -

pkgs.unbound-full

Validating, recursive, and caching DNS resolver

  • nixos-unstable -

Package maintainers