{
  "cveId": "CVE-2023-30624",
  "url": "https://patchblox.com/security/cve/CVE-2023-30624",
  "summary": "CVE-2023-30624 is fixed in ecs-service-connect-agent on 1 platform by ALAS2023-2023-344 (version v1.27.0.0-1.amzn2023), released September 14, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ecs-service-connect-agent: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2023-32067:\n\tDenial o...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2023-32067:\n\tDenial of Service.\n\nAttack Steps:\n\nThe target resolver sends a query\nThe attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver\nThe target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. (this is only valid for TCP connections, UDP is connection-less)\nCurrent resolution fails, DoS attack is achieved.\n\nCVE-2023-31147:\n\tInsufficient randomness in generation of DNS query IDs\n\nWhen /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output.\nInput from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation.\nNo attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available.\n\nCVE-2023-31130:\n\tares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \u00220::00:00:00/2\u0022 was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist().\n\nHowever, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues.\n\nCVE-2023-31124:\n\tWhen cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG.\n\nCVE-2023-30624:\n\tWasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime\u0027s implementation of managing per-instance state, such as tables and memories, contains LLVM-level undefined behavior. This undefined behavior was found to cause runtime-level issues when compiled with LLVM 16 which causes some writes, which are critical for correctness, to be optimized away. Vulnerable versions of Wasmtime compiled with Rust 1.70, which is currently in beta, or later are known to have incorrectly compiled functions. Versions of Wasmtime compiled with the current Rust stable release, 1.69, and prior are not known at this time to have any issues, but can theoretically exhibit potential issues.\n\nThe underlying problem is that Wasmtime\u0027s runtime state for an instance involves a Rust-defined structure called \u0060Instance\u0060 which has a trailing \u0060VMContext\u0060 structure after it. This \u0060VMContext\u0060 structure has a runtime-defined layout that is unique per-module. This representation cannot be expressed with safe code in Rust so \u0060unsafe\u0060 code is required to maintain this state. The code doing this, however, has methods which take \u0060\u0026self\u0060 as an argument but modify data in the \u0060VMContext\u0060 part of the allocation. This means that pointers derived from \u0060\u0026self\u0060 are mutated. This is typically not allowed, except in the presence of \u0060UnsafeCell\u0060, in Rust. When compiled to LLVM these functions have \u0060noalias readonly\u0060 parameters which means it\u0027s UB to write through the pointers.\n\nWasmtime\u0027s internal representation and management of \u0060VMContext\u0060 has been updated to use \u0060\u0026mut self\u0060 methods where appropriate. Additionally verification tools for \u0060unsafe\u0060 code in Rust, such as \u0060cargo miri\u0060, are planned to be executed on the \u0060main\u0060 branch soon to fix any Rust-level issues that may be exploited in future compiler versions.\n\nPrecomplied binaries available for Wasmtime from GitHub releases have been compiled with at most LLVM 15 so are not known to be vulnerable. As mentioned above, however, it\u0027s still recommended to update.\n\nWasmtime version 6.0.2, 7.0.1, and 8.0.1 have been issued which contain the patch necessary to work correctly on LLVM 16 and have no known UB on LLVM 15 and earlier. If Wasmtime is compiled with Rust 1.69 and prior, which use LLVM 15, then there are no known issues. There is a theoretical possibility for undefined behavior to exploited, however, so it\u0027s recommended that users upgrade to a patched version of Wasmtime. Users using beta Rust (1.70 at this time) or nightly Rust (1.71 at this time) must update to a patched version to work correctly.",
  "published": "2023-09-14T00:54:00Z",
  "severity": "important",
  "epss": 0.0045,
  "epssPercentile": 0.3933,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ecs-service-connect-agent",
      "release": "amzn 2023",
      "fixedVersion": "v1.27.0.0-1.amzn2023",
      "fix": "ALAS2023-2023-344",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-344",
      "released": "2023-09-14T00:54:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}