tOS DNS Resolver — Remote Out-of-Bounds Stack Read
In dns_resolve of dns.c, the DNS response parser advances a read position through a fixed-size stack buffer using length values taken directly from the received UDP response, without validating that the position stays within the bounds of the actual packet length before dereferencing it. A malicious or spoofed DNS server can craft a response that causes the parser to read past the end of the received data, resulting in an out-of-bounds stack read. No local privileges are required; the flaw is reachable by any remote host able to respond to a DNS query issued by the device (e.g. via ping
Having seen the 'blindly trust a length value from a file/packet' pattern in both ASI-2026-0001 and ASI-2026-0002, we suspected the same pattern might exist in the network stack and started auditing kernel/net. Reviewing dns_resolve in dns.c, we found that label and record lengths from the DNS response were used to advance the read position with no bounds checking at all.
The DNS response parser keeps a read position over a fixed-size stack buffer and advances that position using label-length and rdlength values read directly from the received UDP response. Before each subsequent read, the parser never checked whether this position stayed within the actual bounds of the received packet. As a result, the parser could read past the end of the received data into undefined regions of the stack.
An attacker (a malicious or spoofed DNS server) responds to a DNS query issued by the device with a response whose label lengths or rdlength fields are deliberately set beyond the actual size of the packet. This query is triggered whenever any hostname-resolving command runs on the device, such as ping
The DNS parser implicitly trusted the contents of an incoming UDP packet — including label-length and rdlength fields — without ever validating, while advancing the read position, that it remained within the actual bounds of the received response.
We added explicit bounds checks against the actual received packet length before every read of a length-prefixed field during name/answer parsing. Malformed or truncated responses are now rejected instead of being read past the buffer.
CWE-125, CWE-20
Artfical DT Developer Talha Berk Arslan