FreeRTOS-Plus-TCP Buffer Overflow Vulnerability in LLMNR and mDNS Query Processing

A buffer overflow vulnerability allowing out-of-bounds write has been identified in FreeRTOS-Plus-TCP. This issue arises when processing LLMNR or mDNS queries that contain very long DNS names. The vulnerability affects systems using Buffer Allocation Scheme 1, with LLMNR or mDNS enabled. Affected versions include FreeRTOS-Plus-TCP v2.3.4 through v4.3.1 (with LLMNR) and v4.0.0 through v4.3.1 (with mDNS).

Impact

Exploitation of this vulnerability leads to a buffer overflow, allowing for out-of-bounds write, which can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

Users are advised to upgrade to FreeRTOS-Plus-TCP version 4.3.2 and ensure that any forked or derivative code is also updated to include the latest fixes.