CVE-2024-25629 - c-ares `ares__read_line()` Buffer Underflow Vulnerability Explained

On February 22, 2024, a security vulnerability identified as CVE-2024-25629 was disclosed in the popular c-ares C library. c-ares provides asynchronous DNS requests and is widely used in networking applications, notably in projects like Node.js, curl, Wireshark, and more. This vulnerability centers around unsafe handling of certain configuration files — if the files contain a line starting with a NULL byte, c-ares may attempt to read memory before the intended buffer, potentially leading to a crash.

In this post, we’ll break down the vulnerability, show you code snippets demonstrating the buggy logic, discuss how attackers could exploit it, and explain how to fix and protect your system.

Understanding the Root Cause

c-ares uses the internal function ares__read_line() to parse several configuration files, among them:

- /etc/resolv.conf
- /etc/nsswitch.conf

HOSTALIASES

- (prior to version 1.27.) /etc/hosts

Here’s a simplified explanation: The library reads these files line by line. But when it encounters a line starting with the binary NULL (\), the logic attempts to process it like any other line — but certain string operations expect only valid UTF-8 or ASCII data. This can trick the function into reading memory just before the start of the buffer (buffer underflow), which leads to a segfault or crash.

Here’s a pseudo-simplified view of the buggy code, focused on the main issue

static int ares__read_line(FILE *fp, char *buf, size_t buflen) {
    char *p = buf;
    if (fgets(buf, buflen, fp) == NULL)
        return -1; // EOF or error

    size_t len = strlen(buf); // <== DANGER HERE if buf starts with '\'
    if (buf[len-1] == '\n')
        buf[len-1] = ; // Remove newline

    // ...
    return ;
}

If a line in the config file starts with a NULL byte (\), buf will immediately be a zero-length string. strlen(buf) will be , so buf[len-1] becomes buf[-1], reading memory *before* the start of the buffer!

A malicious or corrupted config file (for example, /etc/resolv.conf) like

nameserver 8.8.8.8
\nameserver 1.1.1.1

(Note: The second line begins with a literal binary NULL, not just the string "\")

Attack Scenario

An attacker would need a way to write or modify config files (/etc/resolv.conf, /etc/nsswitch.conf, etc.) so they contain one or more lines starting with a NULL byte. This could happen if:

The files are auto-generated by another buggy or compromised program.

Once the malformed config file is read by a program using vulnerable c-ares, a crash can occur. This is a denial of service (DoS), not (so far as known) remote code execution.

Here’s how an attacker could reproduce the bug (locally)

printf "nameserver 8.8.8.8\n\nameserver 1.1.1.1\n" > /tmp/bad_resolv.conf
# Now, run a c-ares based resolver, patched to read from /tmp/bad_resolv.conf.
# It will likely crash or behave unexpectedly.

In C code, you could simulate

FILE *fp = fopen("/tmp/bad_resolv.conf", "r");
char buf[256];
while (ares__read_line(fp, buf, sizeof(buf)) == ) {
    // will crash when reading the line starting with \
}

Impact

- Denial of service: If a c-ares based application reads a malformed config file, it can be made to crash.
- No code execution so far: No direct method to run attacker code, but memory safety bugs can sometimes be chained.

Fix: Patch and Update

The bug is fully fixed in c-ares 1.27. and later. The logic was changed to avoid buffer underflow when processing empty or NULL-prefixed lines.

From the official c-ares changelog

> * "fixed off-by-one read buffer underflow in ares__read_line() when input line starts with a null byte (CVE-2024-25629)"

No Workarounds

There’s no reliable workaround. The only effective action is to upgrade c-ares to version 1.27. or higher.

- Release notes with mitigation
- CVE record and NIST entry
- Upstream issue: github.com/c-ares/c-ares/security/advisories/GHSA-c872-9rpc-2qwr

1. Check Your c-ares Version

ldconfig -p | grep cares
# Or, in code:
#include <ares_version.h>
printf("%s\n", ares_version());

If you are running a version prior to 1.27., upgrade now.

Look for embedded NULLs in config files (rare, unless intentionally created)

grep -P '\x00' /etc/resolv.conf /etc/nsswitch.conf

Conclusion

CVE-2024-25629 is a subtle but dangerous bug for c-ares users. It highlights how a single unexpected character in a config file can crash network-facing software. There’s no patch other than replacement — upgrade all vulnerable applications and libraries to c-ares 1.27.+ without delay.

For developers: Always handle buffer indexing with caution, especially after string manipulation functions, to prevent off-by-one or underflow bugs.

Timeline

Published on: 02/23/2024 15:15:09 UTC
Last modified on: 04/19/2024 23:15:09 UTC

CVE-2024-25629 - c-ares `ares__read_line()` Buffer Underflow Vulnerability Explained – Impact, Exploit Details and Remediation