Lucene search

K
vulnrichmentRedhatVULNRICHMENT:CVE-2024-43167
HistoryAug 08, 2024 - 8:24 p.m.

CVE-2024-43167 Unbound: null pointer dereference in unbound

2024-08-0820:24:49
CWE-476
redhat
github.com
8
unbound
null pointer
segmentation fault
denial of service

CVSS3

2.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

AI Score

6.9

Confidence

High

EPSS

0

Percentile

16.3%

SSVC

Exploitation

poc

Automatable

no

Technical Impact

partial

A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.

CVSS3

2.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

AI Score

6.9

Confidence

High

EPSS

0

Percentile

16.3%

SSVC

Exploitation

poc

Automatable

no

Technical Impact

partial