Heap-based buffer overflow in dnsmasq
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dnsmasq | dnsmasq 2.83 | — | No fix listed | CNA |
- dnsmasq Vendor— Affected dnsmasq 2.83 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:* | before 2.83 | Vulnerable | Thekelleys |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:* Versions before 2.83 Vulnerable ·Thekelleys
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
Red Hat 3 advisories
- RHSA-2021:0150 Released 2021-01-19 · Red Hat rating Importantdnsmasq security update
- Red Hat Enterprise Linux AppStream (v. 8) dnsmasq-2.79-13.el8_3.1, dnsmasq-utils-2.79-13.el8_3.1
- RHSA-2021:0151 Released 2021-01-19 · Red Hat rating Importantdnsmasq security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) dnsmasq-2.79-11.el8_2.2, dnsmasq-utils-2.79-11.el8_2.2
- RHSA-2021:0152 Released 2021-01-19 · Red Hat rating Importantdnsmasq security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) dnsmasq-2.79-6.el8_1.1, dnsmasq-utils-2.79-6.el8_1.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
dnsmasq — FEDORA-2021-2e4c3d5a9d
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15699 Heap-based buffer overflow in dnsmasqPriority HIGH 69
- Advisory ·
dnsmasq — FEDORA-2021-84440e87ba
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15699 Heap-based buffer overflow in dnsmasqPriority HIGH 69
Show 2 more groups
- Advisory ·
dnsmasq — GLSA-202101-17
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15699 Heap-based buffer overflow in dnsmasqPriority HIGH 69
- Advisory ·
dnsmasq — DSA-4844
7 records Highest priority Priority HIGH 4 HIGH, 3 LOW
Other records, highest priority first
- TI-2020-15697 Heap-based buffer overflow in dnsmasqPriority HIGH 76
- TI-2020-15698 Heap-based buffer overflow in dnsmasqPriority HIGH 74
- TI-2020-15699 Heap-based buffer overflow in dnsmasqPriority HIGH 69
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:0150 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:0152 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:0151 |
Not affected: 6 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25687
- 2026-10-03 Alias added: GHSA-rv27-69cw-6j7x
References
Sources
- CVE-2020-25687 · CVE Program
- CVE-2020-25687 · NVD
- FIRST EPSS
- GHSA-rv27-69cw-6j7x · GitHub Advisory Database · CC BY 4.0
- CVE-2020-25687 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences