ConnMan DNS Proxy Denial-of-Service and Potential Arbitrary Code Execution Vulnerability

A vulnerability in ConnMan versions through 1.44 allows for a denial-of-service condition and potentially arbitrary code execution. The issue arises in the DNS proxy component, specifically within the 'ns_resolv' lookup string. When the TC (Truncated) bit is set in a DNS response, the lookup string can be NULL or empty. This leads to incorrect length calculations and flawed memory copy operations, causing the application to crash and creating an opportunity for code execution.

Impact

Exploitation of this vulnerability can result in an application crash, causing a denial-of-service condition. Additionally, there is a possibility of arbitrary code execution due to the manipulation of memory operations.