OpenWrt umdns Stack-Based Buffer Overflow Vulnerability in IPv6 Reverse DNS Lookup

A stack-based buffer overflow vulnerability has been identified in the mdns daemon of OpenWrt umdns package, affecting versions prior to 24.10.6 and 25.12.1. The vulnerability arises in the match_ipv6_addresses function while processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. The issue occurs because the domain name is copied from a buffer into a fixed 256-byte stack buffer without proper length validation. This flaw allows an attacker to craft a DNS query that overflows the stack buffer, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, allowing for out-of-bounds writes that could be leveraged for remote code execution.

Remediation

Users can upgrade to OpenWrt versions 24.10.6 or 25.12.1 to address this vulnerability.