CVE-2023-31147
Public on 2023-05-23
Modified on 2024-02-07
Description
Insufficient randomness in generation of DNS query IDs
When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output.
Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation.
No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available.
CVSS v3 Base Score
See breakdown
