CVE-2026-10657

{
  "id": "CVE-2026-10657",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-05T23:16:52.863",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zephyr's DNS resolver detects mDNS (.local) queries in dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) with memcmp(strrchr(query, '.'), \".local\", 7), which always reads a fixed 7 bytes from the suffix pointer. When the resolved hostname's final label is shorter than 7 bytes (e.g. names ending in .org, .com, .net, .io, or a trailing dot), the comparison reads 1-2 bytes past the string's NUL terminator.\n\nThe hostname (query) is the caller-supplied name passed through the standard getaddrinfo()/dns_get_addr_info()/dns_resolve_name() path and is influenceable by operators or remote inputs (server names from configuration, parsed URLs, or app-facing interfaces).\n\nOn a tightly-sized buffer with no slack (for example a userspace getaddrinfo call where the hostname is copied with k_usermode_string_alloc_copy to exactly strlen+1 bytes), the over-read crosses the allocation boundary; if that boundary is unmapped (guard page, memory-domain boundary under MPU, or an address sanitizer) the over-read faults, causing a denial of service. The over-read bytes are never returned, so there is no information disclosure.\n\nThe flaw is compiled only when CONFIG_MDNS_RESOLVER is enabled, exists since v1.10.0, and is fixed by replacing the fixed-length memcmp with a NUL-safe strcmp(ptr, \".local\")."
    },
    {
      "lang": "es",
      "value": "El resolvedor DNS de Zephyr detecta consultas mDNS (.local) en dns_resolve_name_internal() (subsys/net/lib/dns/resolve.c) con memcmp(strrchr(query, ’.’), “.local”, 7), que siempre lee 7 bytes fijos del puntero de sufijo. Cuando la etiqueta final del nombre de host resuelto es más corta que 7 bytes (por ejemplo, nombres que terminan en .org, .com, .net, .io, o un punto final), la comparación lee 1-2 bytes más allá del terminador NUL de la cadena. El nombre de host (consulta) es el nombre proporcionado por el llamador pasado a través de la ruta estándar getaddrinfo()/dns_get_addr_info()/dns_resolve_name() y es influenciable por operadores o entradas remotas (nombres de servidor de la configuración, URLs analizadas o interfaces orientadas a la aplicación). En un búfer de tamaño ajustado sin holgura (por ejemplo, una llamada getaddrinfo en espacio de usuario donde el nombre de host se copia con k_usermode_string_alloc_copy a exactamente strlen+1 bytes), la lectura excesiva cruza el límite de asignación; si ese límite no está mapeado (página de guarda, límite de dominio de memoria bajo MPU, o un sanitizador de direcciones) la lectura excesiva falla, causando una denegación de servicio. Los bytes leídos en exceso nunca se devuelven, por lo que no hay revelación de información. La falla se compila solo cuando CONFIG_MDNS_RESOLVER está habilitado, existe desde la v1.10.0, y se corrige reemplazando el memcmp de longitud fija con un strcmp(ptr, “.local”) seguro contra NUL."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/net/lib/dns/resolve.c"
          ],
          "versions": [
            {
              "version": "1.10.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T18:51:45.471859Z",
          "id": "CVE-2026-10657",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.10.0",
              "versionEndIncluding": "4.4.0",
              "matchCriteriaId": "6E12BDC8-E574-4145-B8B8-F647CC5EB913"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/448a21da12c9ea28f7fd12c6894e03a987b17a27",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-76jh-3j5f-9vq4",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}