Dnsmasq Vulnerabilities | AirLink Notice

Recently published research has identified two sets of vulnerabilities in dnsmasq, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. The following Common Vulnerability and Exposure (CVE) identifiers have been assigned to each of the vulnerabilities:

• DNSSEC handling code.
  
  • CVE-2020-25681 (CVSS 8.1) A heap-based buffer overflow in dnsmasq in the way it sorts RRSets before validating them with DNSSEC data.
  • CVE-2020-25682 (CVSS 8.1) A buffer overflow vulnerability in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data.
  • CVE-2020-25683 (CVSS 5.9) A heap-based buffer overflow in get_rdata subroutine of dnsmasq, when DNSSEC is enabled and before it validates the received DNS entries.
  • CVE-2020-25687 (CVSS 5.9) A heap-based buffer overflow in sort_rrset subroutine of dnsmasq, when DNSSEC is enabled and before it validates the received DNS entries.

• DNS response validation.
  
  • CVE-2020-25684 (CVSS 4.0) Dnsmasq does not validate the combination of address/port and the query-id fields of DNS request when accepting DNS responses.
  • CVE-2020-25685 (CVSS 4.0) Dnsmasq uses a weak hashing algorithm (CRC32) when compiled without DNSSE to validate DNS responses.
  • CVE-2020-25686 (CVSS 4.0) Dnsmasq does not check for an existing pending request for the same name and forwards a new request thus allowing an attacker to do a "Birthday Attack" scenario to forge replies and potentially poison the DNS cache.