CVE-2025-32366 Information

Description

In ConnMan through 1.44 parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value i.e. rdlen=ntohs(rr->rdlen) and memcpy(response+offsetendrdlen).

Reference

https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1001 https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n988