Zephyr DNS Implementation Denial-of-Service Vulnerability Leading to Infinite Loop

A denial-of-service vulnerability has been identified in the Zephyr project DNS implementation, in versions through 4.1. This issue can cause an infinite loop by manipulating the 'pos' variable in the 'dns_copy_qname' function, creating a scenario where the same position is revisited repeatedly. This vulnerability arises from improper handling of DNS label compression, allowing malicious packets to exploit the logic and disrupt normal processing.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the application to enter an infinite loop and potentially consume excessive resources.