CVE-2020-14354: 
NixOS vulnerability analysis and mitigation

A possible use-after-free and double-free vulnerability was discovered in c-ares library version 1.16.0, specifically when ares_destroy() is called prior to ares_getaddrinfo() completing. The vulnerability was reported by Jann Horn from Google Project Zero (Red Hat Bugzilla).

The vulnerability occurs in the c-ares library's host_callback() function where end_hquery() is called twice in the ARES_EDESTRUCTION case, potentially leading to a use-after-free condition and double-free of memory. The issue was introduced in version 1.16.0 and affects the ares_getaddrinfo() functionality. The vulnerability has a CVSS v3.1 Base Score of 3.3 (Low) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (NVD).

This vulnerability allows an attacker to crash the service that uses the c-ares library, primarily affecting service availability. The highest threat from this vulnerability is to service availability, with no direct impact on confidentiality or integrity (CVE).

The vulnerability requires local access and low complexity to exploit. It specifically occurs during the interaction between ares_destroy() and ares_getaddrinfo() functions, making it exploitable in scenarios where these functions are used together (NVD).

The vulnerability was fixed in c-ares version 1.16.1. As a workaround before updating, calling wait_ares(channel) before ares_destroy() in the service that uses c-ares can prevent this bug (Red Hat Bugzilla). The fix involved adding a return statement after the first end_hquery() call in the ARES_EDESTRUCTION case to prevent the double-free condition (C-ares Commit).