CVE-2020-25682CWE-122

CVE-2020-25682: vulnerability in dnsmasq

Published · Updated

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 71%
exploitation probability
71%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products (63 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.1) · Red Hat Enterprise Linux AppStream EUS (v. 8.2)
fix ↗
Not affected
6 products (12 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 5 · Red Hat OpenStack Platform 10 (Newton) · and others 1
In short

A buffer overflow vulnerability in dnsmasq allows an attacker on the network to send specially crafted DNS replies that overflow memory and potentially execute code on the target system.

Technical detail

The vulnerability exists in the extract_name() function in rfc1035.c, which fails to properly validate buffer boundaries when extracting domain names from DNS packets before DNSSEC validation. An attacker with the ability to craft valid DNS replies can trigger a heap buffer overflow by providing domain names that exceed the assumed buffer size, potentially achieving remote code execution.

Summary generated and translated by AI from the official description.
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products
n/a · dnsmasq
References
https://bugzilla.redhat.com/show_bug.cgi?id=1882014https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://www.kb.cert.org/vuls/id/434904