Bug 2028468 (CVE-2020-19861) - CVE-2020-19861 ldns: Heap out-of-bound read vulnerability in ldns_nsec3_salt_data function
Summary: CVE-2020-19861 ldns: Heap out-of-bound read vulnerability in ldns_nsec3_salt_...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-19861
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2028469
Blocks: 2028476
TreeView+ depends on / blocked
 
Reported: 2021-12-02 12:44 UTC by Pedro Sampaio
Modified: 2022-01-25 16:49 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-12-14 07:08:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2021-12-02 12:44:50 UTC 
In ldns before 1.8.0 when the zone file is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap information leakage.

References:

https://github.com/NLnetLabs/ldns/blob/d3955248eb409b6af0cc6f33e3d458e7f1f555cf/Changelog
https://github.com/NLnetLabs/ldns/issues/51
Comment 1 Pedro Sampaio 2021-12-02 12:45:05 UTC 
Created ldns tracking bugs for this issue:

Affects: fedora-all [bug 2028469]
Note You need to log in before you can comment on or make changes to this bug.