Zephyr's DNS resolver (subsys/net/lib/dns) does not properly validate the resource record (RR) data length in DNS responses. Specifically, dns_unpack_answer() only validates the fixed RR header fields but accepts any attacker-declared rdlength, even if it extends past the end of the received datagram. The TXT and SRV record consumers in dns_validate_record() then read up to rdlength bytes from the receive buffer without bounds checking against the packet size, leading to an out-of-bounds read. This can leak residual memory contents or cause a denial of service if the read crosses allocation boundaries. The read is limited to approximately 64 bytes for TXT and 6 bytes for SRV records. The vulnerability can be exploited by a malicious or spoofed DNS server, an on-path attacker forging UDP DNS replies, or any LAN node if mDNS/LLMNR is enabled. The fix involves rejecting any record whose declared rdata extends past the message size at the chokepoint in dns_unpack_answer(). Affected versions include 2.7.0 and 4.3.0.

An attacker can cause an out-of-bounds read of adjacent receive-pool memory by sending specially crafted DNS TXT or SRV responses. This results in an information leak of stale or uninitialized memory contents to the application, which may expose sensitive data. In some configurations, the out-of-bounds read can cross allocation boundaries and cause a denial of service due to a fault. The vulnerability does not allow writing or code execution. The attack requires network access to send spoofed or malicious DNS responses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The disclosed fix rejects any DNS record whose declared rdata length extends beyond the received message size at the single chokepoint in dns_unpack_answer(). Until an official fix is available, consider disabling mDNS/LLMNR if enabled to reduce exposure to LAN-based attackers. Monitor vendor communications for patches or updates addressing this issue.