Denial of Service and Potential Code Execution in ConnMan by The Linux Foundation

CVE-2025-32743

What is CVE-2025-32743?

In ConnMan versions up to 1.44, a significant vulnerability exists in the DNS response handling process. Specifically, when the TC (Truncated) bit is set, the application can utilize a NULL or empty string as a lookup value, resulting in erroneous length calculations and flawed memory operations. This vulnerability can lead to unexpected crashes of the application or expose the software to potential arbitrary code execution, endangering the integrity and security of the affected systems. It is crucial for users of ConnMan to assess their exposure and take appropriate measures to mitigate the risks associated with this flaw.

References