Description

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T22:18:10.743Z",
  "pubdate": "2026-08-06T22:18:10.743Z",
  "executiveSummary": "Contiki-NG contains an out-of-bounds read vulnerability within its DNS and mDNS resolver implementation located in os/services/resolv/resolv.c.\nThe vulnerability arises due to the skip_name() function walking DNS wire-format name labels without implementing proper packet-boundary checks.\nThe caller within newdata() invokes skip_name() in a loop controlled by the attacker-supplied nquestions field from the DNS header prior to validating the transaction ID.\nAn unauthenticated attacker can exploit this flaw by setting nquestions higher than the actual number of complete questions present in the packet, forcing skip_name() to read past the boundary of the UDP packet buffer.\nThe resulting out-of-bounds pointer is subsequently cast to struct dns_answer *, enabling further unauthorized memory reads.\nFor builds utilizing RESOLV_CONF_SUPPORTS_MDNS, any peer on the local network segment can trigger the vulnerability via unauthenticated multicast UDP traffic on port 5353 without requiring an outstanding query.\nFor standard DNS configurations, an attacker capable of injecting a UDP response from port 53 during an active query can trigger the same memory disclosure condition.\nThe primary impacts of successful exploitation include the disclosure of sensitive contents from uip_buf and adjacent memory regions, or a denial of service resulting from a resolver crash.",
  "technicalDetails": "The root cause of the vulnerability resides in the skip_name() function inside os/services/resolv/resolv.c, which parses DNS wire-format name labels without validating whether pointer traversal exceeds the allocated packet buffer boundaries.\nThe vulnerable execution flow begins when the newdata() function processes incoming UDP DNS packets and iterates nquestions times based directly on values parsed from the attacker-controlled DNS header.\nCrucially, this iteration and name-skipping occurs before the DNS resolver validates the transaction ID, exposing the parsing logic to untrusted input.\nIf an attacker constructs a malformed DNS or mDNS packet specifying an nquestions value that exceeds the actual count of complete question structures present in the payload, skip_name() continues to advance its parsing pointer beyond the limits of the UDP packet buffer.\nOnce skip_name() overreads the buffer, the returned out-of-bounds pointer is unsafely cast to a struct dns_answer * type, facilitating subsequent memory read operations against adjacent memory spaces.\nNetwork exposure and attack vectors depend on the build configuration. When RESOLV_CONF_SUPPORTS_MDNS is enabled, local network peers can trigger the vulnerability without authentication by transmitting a multicast UDP packet to port 5353, requiring no prior or concurrent network dialog.\nIn standard DNS deployments, exploitation requires the attacker to inject a malicious UDP response packet originating from port 53 while an outstanding DNS query is active.\nThe post-exploitation impact is characterized by unauthorized memory disclosure of uip_buf and adjacent kernel or application memory, alongside potential system instability leading to a denial of service via resolver crashes."
}