CVE-2021-33833

Name of the Vulnerable Software and Affected Versions ConnMan versions 1.30 through 1.39

Description The issue is related to a stack-based buffer overflow in the dnsproxy package of ConnMan, which can be exploited by a remote attacker to execute arbitrary code. The overflow occurs in the uncompress function in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA records).

Recommendations For versions 1.30 through 1.39, consider disabling the uncompress function in dnsproxy.c as a temporary workaround until a patch is available. Restrict access to the dnsproxy package to minimize the risk of exploitation. Avoid using the NAME, RDATA, or RDLENGTH variables in the affected API endpoints until the issue is resolved.