CVE-2024-38373 CRITICAL

CVE-2024-38373: FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser

Vendor Freertos
Product FreeRTOS-Plus-TCP
Weakness CWE-126
Published June 24, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

What the vulnerability does

01Description

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.

Key dates

02Disclosure timeline

June 24, 2024 CVE published
August 2, 2024 Record updated