Use-After-Free and Double-Free Vulnerability in c-ares Library by Haxx

CVE-2020-14354

What is CVE-2020-14354?

A potential use-after-free and double-free vulnerability exists in the c-ares library version 1.16.0. This issue can occur if the ares_destroy() function is executed prior to the ares_getaddrinfo() function completing. An attacker can exploit this flaw, leading to instability and possible crashes in any service utilizing the c-ares library, thereby impacting service availability. It is crucial for system administrators and developers using this library to review their implementations and apply necessary updates to mitigate the risk of service disruption.

References