dnsmasq vulnerabilities

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet carrying RFC 7871 client subnet information. The flaw enables circumvention of query origin verification mechanisms.

An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.

A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.

In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.

Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

The DNSSEC validation in dnsmasq has a denial of service (DoS) vulnerability. A remote attacker can send a crafted DNS packet, causing the service to crash.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

A flaw was found in dnsmasq: when DHCP leasequery is enabled without an allowed source address list, the server does not verify who sent the query. A host on the local network can query DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator enables it.

In dnsmasq, the DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

In dnsmasq, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format after internal buffer sizes were reduced. An attacker able to force validation of a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

In dnsmasq, when following a CNAME in a DNS response, the resolver can cache records for the CNAME target without verifying they belong to the responding server's authorized zone. In split-DNS deployments sending some domains to a specific upstream, an attacker controlling that upstream can inject cache entries for unrelated names.

The TCP DNS service in dnsmasq uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation requiring TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

The TFTP server in dnsmasq can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network able to request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record's end.

Heap-based out-of-bounds write in dnsmasq DHCPv6 allows local attackers to execute code as root.

The extract_name() function in dnsmasq is vulnerable to a heap buffer overflow, allowing an attacker to inject false DNS cache entries. This can result in DNS lookups being redirected to an attacker-controlled IP address or cause a denial of service (DoS).