CVE-2020-25687CWE-122

CVE-2020-25687: vulnerability in dnsmasq

Published · Updated

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 87%
exploitation probability
87%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products (63 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.1) · Red Hat Enterprise Linux AppStream EUS (v. 8.2)
fix ↗
Not affected
6 products (12 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 5 · Red Hat OpenStack Platform 10 (Newton) · and others 1
In short

A flaw in dnsmasq allows a remote attacker to crash the DNS service by sending specially crafted DNS replies when DNSSEC validation is enabled. This happens because the software doesn't properly check the length of data before copying it to memory.

Technical detail

A heap-based buffer overflow in dnsmasq's extract_name() function (rfc1035.c) occurs before DNSSEC validation, triggered by remote DNS replies with insufficient length checks. The vulnerability leads to negative-size memcpy() calls in sort_rrset(), causing a denial of service; exploitation requires the ability to craft valid DNS responses.

Summary generated and translated by AI from the official description.
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Affected products
n/a · dnsmasq
References
https://bugzilla.redhat.com/show_bug.cgi?id=1891568https://lists.debian.org/debian-lts-announce/2021/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/https://security.gentoo.org/glsa/202101-17https://www.debian.org/security/2021/dsa-4844https://www.jsof-tech.com/disclosures/dnspooq/https://www.kb.cert.org/vuls/id/434904