CVE-2024-38373

The DNS response parser in FreeRTOS-Plus-TCP does not properly validate the length of the domain name contained in the DNS response. An attacker can craft a DNS response in which the domain name length field indicates a value greater than the actual length of that name. As a result, the parser reads data beyond the boundary of the DNS response buffer (CWE-125: Out-of-bounds Read, CWE-126: Buffer Over-read). The vulnerability only affects applications actively using DNS functionality — applications not using DNS are not exposed, even if DNS support is compiled into the code.

An attacker can obtain unauthorized read access to device memory fragments (confidential data leak) and potentially trigger a network stack crash leading to denial of service (DoS). The attack vector is network-based and does not require prior authentication at the target application level.

FreeRTOS-Plus-TCP should be updated to version 4.1.1, in which the vulnerability has been fixed. Patch is available in the official GitHub repository under the V4.1.1 tag. As a temporary workaround, disabling or limiting DNS functionality in applications that do not require it can be considered.

FreeRTOS-Plus-TCP in versions 4.0.0 and 4.1.0 — applications using DNS functionality. Applications not using DNS are not vulnerable.