Buffer Over-read Vulnerability in FreeRTOS-Plus-TCP DNS Response Parser

CVE-2024-38373

What is CVE-2024-38373?

FreeRTOS-Plus-TCP, a tcp/ip stack designed for FreeRTOS, has been identified with a buffer over-read vulnerability specifically in its DNS Response Parser. The issue arises when parsing domain names from a DNS response, allowing a crafted response with an inaccurate domain name length to prompt the parser to read beyond the allocated DNS response buffer. While this vulnerability impacts applications that utilize the DNS functionality of the FreeRTOS-Plus-TCP stack, it is important to note that applications not employing DNS features remain unaffected, even if DNS functionality is enabled. A patch addressing this security concern was released in version 4.1.1.

References