CVE-2014-3484

What it actually does

Stack-based buffer overflows in the __dn_expand function in musl libc triggered by invalid name lengths in DNS responses, leading to memory corruption that can cause crashes via infinite loops or allow unspecified remote code execution.

Why it matters to the business

Potential remote compromise or denial of service for systems relying on affected musl-based components in networked applications, increasing operational risk for organizations using older versions of the impacted software package.

How an attack unfolds

An attacker crafts a malicious DNS response containing an invalid name length field and sends it to a vulnerable application using the affected musl libc; the __dn_expand function processes the response without proper bounds checking, resulting in a stack overflow that can be leveraged for code execution or to induce a crash through an infinite loop with no output.

How to fix it

Upgrade gitlab-runner to the fixed commit e639e0f38038777a2e3ded22be4255e41a398e34 or later; for any downstream musl libc usage, update to version 1.1.2 or newer to resolve the buffer overflow in dn_expand.c.

How to confirm the fix worked

Verify the running binary or package version against the fixed commit hash or musl release 1.1.2+; test DNS response handling with crafted invalid name length packets in a controlled environment to confirm absence of overflow behavior.

Typical attack path

1. Identify a target application or service that uses the vulnerable musl libc version and performs DNS resolution or handling
2. Craft and transmit a DNS response packet with an invalid name length value
3. Trigger the buffer overflow condition in __dn_expand during response parsing
4. Leverage memory corruption to execute arbitrary code or cause application crash

How to detect it

Search application logs and system crash reports for repeated DNS handling failures or segmentation faults originating from musl libc functions; inspect network traffic captures for anomalous DNS responses with unusual name length fields.

What your security team should do

• Prioritize upgrade of gitlab-runner to the specified fixed commit due to the high CVSS and stable but non-zero EPSS
• Review all musl libc dependencies across the environment and apply updates
• Implement network segmentation or DNS response validation where immediate patching is delayed
• Monitor vulnerability disclosure feeds for any future exploitation reports given the 2421 days since publication