CVE-2020-14354

low-risk
Published 2021-05-13

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (2)

C-Ares

Affected Vendors

Fedoraproject C-Ares

References (10)

Exploit https://bugzilla.redhat.com/show_bug.cgi?id=1866838
Release Notes https://c-ares.haxx.se/changelog.html
Patch https://github.com/c-ares/c-ares/commit/1cc7e83c3bdfaafbc5919c95025592d8de3a170e
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Exploit https://packetstormsecurity.com/files/158755/GS20200804145053.txt
Exploit https://bugzilla.redhat.com/show_bug.cgi?id=1866838
Release Notes https://c-ares.haxx.se/changelog.html
Patch https://github.com/c-ares/c-ares/commit/1cc7e83c3bdfaafbc5919c95025592d8de3a170e
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Exploit https://packetstormsecurity.com/files/158755/GS20200804145053.txt
21
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 7/34 · Low