Use-After-Free Vulnerability in Systemd Affecting DNS Processing

CVE-2022-2526

What is CVE-2022-2526?

A use-after-free vulnerability has been identified in Systemd, specifically in the DNS resolution code. The issue arises from the improper handling of reference counting in the 'resolved-dns-stream.c' file, particularly within the on_stream_io() and dns_stream_complete() functions. When these functions fail to correctly manage the reference count of the DnsStream object, it may lead to the dereferencing of a freed object in subsequent calls. This flaw poses a significant risk as it can be exploited through various callbacks, potentially leading to unpredictable application behavior and security breaches.

References