REDHAT-BUG-2490763: Buffer Overflow
A heap buffer overflow exists in dnsmasq's logquery() function (src/cache.c). When query logging is enabled and dnsmasq logs DS or DNSKEY replies containing unsupported algorithm or digest types, the "(not supported)" suffix causes sprintf() to write past the end of daemon->addrbuff, a 46-byte heap buffer. Trigger example: a DS record with keytag=65535, algorithm=255, digesttype=255 (both algorithm 255 and digesttype 255 are IANA-unassigned), causing the "(not supported)" branch in dnssec.c to fire during logging. Prerequisites: - DNSSEC validation enabled - Query logging enabled (e.g. --log-queries) Impact: bounded heap write overflow (~12 bytes). Upstream maintainer Simon Kelley notes the overwrite is of bounded length, the bytes written are not attacker-controlled, and this is not considered a likely remote-execution vector. Practical impact is denial of service via process crash or heap corruption. Fixed upstream in commit 36d081e37477027fd721fea498f3760f529034ad (dnsmasq 2.92rel2).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dnsmasqto a version that resolves this vulnerability.Fixed in 2.92rel2Patch 36d081e37477027fd721fea498f3760f529034ad - Configuration
Disable dnsmasq query logging (e.g., do not run with --log-queries). The heap buffer overflow is triggered in log_query() when query logging is enabled and dnsmasq logs DS or DNSKEY replies containing attacker-controlled unsupported algorithm/digest_type values.
dnsmasq (logging) query logging (e.g., --log-queries) = disabled
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490763?
The severity of REDHAT-BUG-2490763 is medium, rated at 4.
How do I fix REDHAT-BUG-2490763?
To fix REDHAT-BUG-2490763, update the Dnsmasq software to the latest patched version.
What kind of vulnerability is REDHAT-BUG-2490763?
REDHAT-BUG-2490763 is a heap buffer overflow vulnerability.
What causes the vulnerability in REDHAT-BUG-2490763?
The vulnerability in REDHAT-BUG-2490763 is caused by improper handling of unsupported algorithm or digest types when logging DNS queries.
What is affected by REDHAT-BUG-2490763?
The Dnsmasq software is affected by the vulnerability REDHAT-BUG-2490763.