CVE-2024-38373 Overview
CVE-2024-38373 is a buffer over-read vulnerability in the DNS Response Parser of FreeRTOS-Plus-TCP, a lightweight TCP/IP stack for FreeRTOS. Affected versions include 4.0.0 through 4.1.0. A malformed DNS response containing a domain name length value greater than the actual domain name length can cause the parser to read beyond the DNS response buffer. The issue impacts embedded and Internet of Things (IoT) applications that use the DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS are not affected, even if DNS support is compiled in. The vendor patched the flaw in version 4.1.1.
Critical Impact
A network-adjacent attacker able to inject or spoof DNS responses can trigger out-of-bounds memory reads that may cause denial of service or disclose adjacent memory on embedded devices.
Affected Products
- Amazon FreeRTOS-Plus-TCP version 4.0.0
- Amazon FreeRTOS-Plus-TCP versions between 4.0.0 and 4.1.0
- Amazon FreeRTOS-Plus-TCP version 4.1.0
Discovery Timeline
- 2024-06-24 - CVE-2024-38373 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-38373
Vulnerability Analysis
The vulnerability resides in the DNS Response Parser within the FreeRTOS-Plus-TCP stack. DNS responses encode domain names using a length-prefixed label format, where each label begins with a byte indicating the label length followed by the label characters. The parser trusts the length byte supplied by the response without validating it against the remaining bytes in the response buffer.
When the length value exceeds the actual bytes available in the packet, the parser continues reading past the end of the DNS response buffer. This produces an out-of-bounds read classified under [CWE-125] and buffer over-read [CWE-126]. On memory-constrained embedded targets, the read can access adjacent heap or stack memory belonging to other tasks.
Consequences depend on the memory layout of the device. Impact ranges from parser crashes and denial of service to unintended disclosure of sensitive process memory returned to attacker-controlled response paths. The CVSS vector reflects a network-reachable attack requiring low privileges with high impact to confidentiality and availability.
Root Cause
The DNS Response Parser processes domain name length fields without bounds-checking them against the remaining size of the received DNS packet. Missing validation between the untrusted length prefix and the parser's read pointer allows the read to progress beyond the buffer.
Attack Vector
An attacker positioned to send or spoof DNS responses to a FreeRTOS device—for example on the same broadcast domain, via an upstream resolver, or through DNS spoofing—crafts a response where a domain name length byte exceeds the true label length. The device parses the response and reads past the buffer boundary during name resolution.
No authenticated code examples are published for this issue. See the FreeRTOS-Plus-TCP Security Advisory GHSA-ppcp-rg65-58mv for vendor technical details.
Detection Methods for CVE-2024-38373
Indicators of Compromise
- Unexpected restarts, watchdog resets, or task crashes on FreeRTOS devices coinciding with DNS activity.
- DNS response packets where a label length byte exceeds the number of bytes remaining in the UDP payload.
- Malformed or truncated DNS answers arriving from resolvers that normally return well-formed responses.
Detection Strategies
- Inspect DNS responses at the network boundary and drop packets where declared label lengths exceed the actual payload size.
- Enable device-side logging of DNS parser errors and correlate error bursts with source addresses of responding resolvers.
- Track firmware versions of deployed FreeRTOS devices and flag any running FreeRTOS-Plus-TCP 4.0.0 through 4.1.0.
Monitoring Recommendations
- Monitor UDP port 53 traffic to and from embedded devices for anomalous response sizes and label structures.
- Alert on repeated DNS query failures or repeated device reboots that follow DNS traffic patterns.
- Ingest device telemetry into a centralized data lake to correlate crash events across a fleet of embedded devices.
How to Mitigate CVE-2024-38373
Immediate Actions Required
- Upgrade FreeRTOS-Plus-TCP to version 4.1.1 or later on all devices that use DNS.
- Inventory all firmware images that include the FreeRTOS-Plus-TCP stack and identify DNS usage.
- Restrict which DNS resolvers devices can reach by configuring firewall rules or trusted resolver lists.
Patch Information
The vendor released the fix in FreeRTOS-Plus-TCP version 4.1.1. Refer to the FreeRTOS-Plus-TCP V4.1.1 release notes and the security advisory GHSA-ppcp-rg65-58mv for the patch details and integration guidance.
Workarounds
- Disable DNS functionality in the FreeRTOS-Plus-TCP configuration if the application does not require name resolution.
- Place affected devices on isolated network segments where only trusted DNS resolvers are reachable.
- Deploy DNS response validation at an upstream gateway to filter malformed label lengths before packets reach embedded devices.
# Configuration example: disable DNS in FreeRTOSIPConfig.h if unused
#define ipconfigUSE_DNS 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
