CVE-2020-14354: c-ares Classic Buffer Overflow

Vulnerability summary

CVE-2020-14354 is a low (CVSS 3.3) Classic Buffer Overflow vulnerability in c-ares. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 13-05-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
• CWE-415Double FreeThe product calls free() twice on the same memory address.
• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.