Log in Start free

Vulnerability · Published Apr 5, 2025 · Assigned by mitre

CVE-2025-32366

Medium 4.8

In plain English

A medium-severity security flaw in ConnMan from ConnMan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.4%top 64.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be larger than the amount of remaining packet data in the current state of parsing. Values of stack memory locations may be sent over the network in a response.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12connmanno fix listedDEBIAN-CVE-2025-32366
Debian:13connman1.44-3DEBIAN-CVE-2025-32366
Debian:14connman1.44-3DEBIAN-CVE-2025-32366
Ubuntu:22.04:LTSconnmanno fix listedUBUNTU-CVE-2025-32366
Ubuntu:24.04:LTSconnmanno fix listedUBUNTU-CVE-2025-32366
Ubuntu:25.10connmanno fix listedUBUNTU-CVE-2025-32366
Ubuntu:26.04:LTSconnmanno fix listedUBUNTU-CVE-2025-32366
Ubuntu:26.10connmanno fix listedUBUNTU-CVE-2025-32366

Affected products (as reported)

VendorProductVersions
ConnMan ConnMan 0 – through 1.44

Weakness: CWE-130 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

References