Cloudanix VulnDB

CVE-2025-31498

None

CVSS

—

EPSS

0.6%

Published

Apr 8, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a DNS lookup library used by enterprise applications can cause crashes when handling certain network responses, requiring updates to keep services stable.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Denial Of Service
Component
Library
Class
Use After Free
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in read_answers() after process_answer() re-enqueues a query on DNS cookie failure, missing EDNS support, or TCP connection close, allowing the handle to be freed while still referenced.

Why it matters to the business

Applications relying on asynchronous DNS resolution in Red Hat JBoss EAP 7.3 deployments face risk of crashes or memory corruption that can disrupt services and require emergency patching across numerous dependent packages.

How an attack unfolds

An attacker controlling an upstream nameserver returns responses triggering re-enqueue conditions; combined with ICMP unreachable packets or local send/write failures, this causes the connection handle to be closed prematurely while read_answers() still references it, resulting in use-after-free.

How to fix it

Upgrade affected Red Hat JBoss Enterprise Application Platform 7.3 packages to the listed fixed versions: eap7-undertow to 2.0.35-1.SP1_redhat_00001.1.el7eap, eap7-bouncycastle* packages to 1.68.0-2.redhat_00005.1.el7eap, eap7-hal-console to 3.2.14-1.Final_redhat_00001.1.el7eap, eap7-infinispan* packages to 9.4.22-3.Final_redhat_00001.1.el7eap, eap7-ironjacamar* packages to 1.4.30-1.Final_redhat_00001.1.el7eap, and eap7-jboss-genericjms to 2.0.9-1.Final_redhat_00001.1.el7eap; ensure underlying c-ares reaches 1.34.5 or later.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases for each eap7-* component; test DNS resolution paths under failure conditions to confirm absence of crashes.

Typical attack path

  1. Position as or compromise upstream DNS server
  2. Return response causing DNS cookie failure or EDNS incompatibility
  3. Trigger connection close or send failure via ICMP or local conditions
  4. Force re-enqueue in process_answer() while read_answers() expects valid handle
  5. Trigger use-after-free leading to crash or potential memory corruption

How to detect it

Search application and system logs for crashes or segmentation faults during DNS resolution; inspect for unexpected connection closures in c-ares related code paths.

What your security team should do

  • Prioritize immediate upgrade of all listed eap7 packages to fixed versions due to widespread dependency in EAP 7.3
  • Monitor for application crashes during DNS operations as interim detection
  • Review and restrict local process permissions to limit local trigger vectors

The record

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:10 nodejs 0 1:22.15.0-1.el10_0
AlmaLinux:10 nodejs-devel 0 1:22.15.0-1.el10_0
AlmaLinux:10 nodejs-docs 0 1:22.15.0-1.el10_0
AlmaLinux:10 nodejs-full-i18n 0 1:22.15.0-1.el10_0
AlmaLinux:10 nodejs-libs 0 1:22.15.0-1.el10_0
AlmaLinux:10 nodejs-npm 0 1:10.9.2-1.22.15.0.1.el10_0
AlmaLinux:8 nodejs 0 1:22.15.0-1.module_el8.10.0+3986+a908e756
AlmaLinux:8 nodejs 0 1:20.19.1-1.module_el8.10.0+3987+dbda4426
AlmaLinux:8 nodejs-devel 0 1:22.15.0-1.module_el8.10.0+3986+a908e756
AlmaLinux:8 nodejs-devel 0 1:20.19.1-1.module_el8.10.0+3987+dbda4426
AlmaLinux:8 nodejs-docs 0 1:22.15.0-1.module_el8.10.0+3986+a908e756
AlmaLinux:8 nodejs-docs 0 1:20.19.1-1.module_el8.10.0+3987+dbda4426
AlmaLinux:8 nodejs-full-i18n 0 1:22.15.0-1.module_el8.10.0+3986+a908e756
AlmaLinux:8 nodejs-full-i18n 0 1:20.19.1-1.module_el8.10.0+3987+dbda4426
AlmaLinux:8 nodejs-libs 0 1:22.15.0-1.module_el8.10.0+3986+a908e756
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.10.0+3983+391a1a04
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.10.0+3982+85c136aa
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.10.0+3961+6a788e57
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.10.0+3987+dbda4426
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.10.0+3961+6a788e57
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.10.0+3958+472a6467
AlmaLinux:8 npm 0 1:10.9.2-1.22.15.0.1.module_el8.10.0+3986+a908e756
AlmaLinux:8 npm 0 1:10.8.2-1.20.19.1.1.module_el8.10.0+3987+dbda4426
AlmaLinux:8 v8-12.4-devel 0 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756
AlmaLinux:9 nodejs 0 1:20.19.1-1.module_el9.6.0+163+d268fe53
AlmaLinux:9 nodejs 0 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
AlmaLinux:9 nodejs-devel 0 1:20.19.1-1.module_el9.6.0+163+d268fe53
AlmaLinux:9 nodejs-devel 0 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
AlmaLinux:9 nodejs-docs 0 1:20.19.1-1.module_el9.6.0+163+d268fe53
AlmaLinux:9 nodejs-docs 0 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
AlmaLinux:9 nodejs-full-i18n 0 1:20.19.1-1.module_el9.6.0+163+d268fe53
AlmaLinux:9 nodejs-full-i18n 0 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
AlmaLinux:9 nodejs-libs 0 1:22.15.0-1.module_el9.6.0+164+2d89b8ed
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.5.0+125+8dc38870
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.5.0+139+09296491
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.6.0+162+8dc602e5
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.5.0+139+09296491
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.6.0+162+8dc602e5
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.5.0+139+09296491
AlmaLinux:9 npm 0 1:10.8.2-1.20.19.1.1.module_el9.6.0+163+d268fe53
AlmaLinux:9 npm 0 1:10.9.2-1.22.15.0.1.module_el9.6.0+164+2d89b8ed
AlmaLinux:9 v8-12.4-devel 0 3:12.4.254.21-1.22.15.0.1.module_el9.6.0+164+2d89b8ed
Alpine:v3.21 c-ares 0 1.34.5-r0
Alpine:v3.22 c-ares 0 1.34.5-r0
Debian:13 c-ares 0 No fix
Debian:14 c-ares 0 1.34.5-1
openSUSE:Tumbleweed c-ares 0 1.34.5-1.1

Related vulnerabilities