Adam Szewczyk

**Name of the Vulnerable Software and Affected Versions** Zephyr versions 4.0.0 through 4.4.0 **Description** The BSD-sockets `getaddrinfo()` implementation in `subsys/net/lib/sockets/getaddrinfo.c` contains a use-after-return flaw. The function passes a pointer to a stack-allocated state object `getaddrinfo state` as the `user data` for an asynchronous DNS resolver query. If the semaphore wait times out, the system retries the query without cancelling the previous one or resetting the semaphore. This leaves an active query slot in the resolver pointing to an out-of-scope stack frame. A subsequent DNS response or a delayed query-timeout can trigger `dns resolve cb()`, causing the system to write to the stale pointer. Since the 16-bit transaction ID used for matching responses is spoofable, a network-based attacker can cause memory corruption, leading to crashes or denial of service. **Recommendations** Update Zephyr versions 4.0.0 through 4.4.0 to a version where the timed-out query is cancelled by name and type before retrying and the local semaphore is reset.