ArchLinux: 202106-48: nginx-mainline: arbitrary code execution
Summary
A security issue in nginx resolver was identified, which might allow an
attacker to cause 1-byte memory overwrite by using a specially crafted
DNS response, resulting in worker process crash or, potentially, in
arbitrary code execution.
The issue only affects nginx if the "resolver" directive is used in the
configuration file. Further, the attack is only possible if an attacker
is able to forge UDP packets from the DNS server.
Resolution
Upgrade to 1.21.0-1.
# pacman -Syu "nginx-mainline>=1.21.0-1"
The problem has been fixed upstream in version 1.21.0.
References
https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html http://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c5cf https://security.archlinux.org/CVE-2021-23017
Workaround
The issue can be mitigated by removing the "resolver" directive fromthe configuration file.