REDHAT-BUG-2491663: Low severity Dnsmasq Dnsmasq vulnerability
An out-of-bounds read vulnerability was found in dnsmasq's findsoa() function in src/rfc1035.c. The function calls extractname() with extrabytes=0 when parsing NS section records in NXDOMAIN/NODATA responses, which only validates that the DNS name fits within the packet but does not verify that 10 additional bytes exist for the fixed-length fields (type, class, TTL, rdlen). The subsequent GETSHORT/GETLONG macros then unconditionally read 10 bytes past the valid packet boundary.
An attacker controlling a DNS zone can trigger this by returning a crafted NXDOMAIN response where the NS record name (a compression pointer) extends to the packet boundary. The 10-byte over-read typically stays within dnsmasq's over-allocated packet buffer (headroom of 1035 bytes), limiting crash risk, but accesses data outside the logical packet boundary and may read stale heap data from prior DNS transactions.
Upstream fix: https://repo.or.cz/dnsmasq.mirror.git/commit/14094e88beca519c53151184cc4553656672b54f Fixed in: dnsmasq 2.93rc1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dnsmasqto a version that resolves this vulnerability.Fixed in 2.93rc1Patch 14094e88beca519c53151184cc4553656672b54f
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2491663?
The severity of REDHAT-BUG-2491663 is low.
What type of vulnerability is REDHAT-BUG-2491663?
REDHAT-BUG-2491663 is classified as an out-of-bounds read vulnerability in dnsmasq.
How does REDHAT-BUG-2491663 affect dnsmasq functionality?
REDHAT-BUG-2491663 affects dnsmasq by allowing improper handling of NS section records in NXDOMAIN/NODATA responses.
What function is impacted by REDHAT-BUG-2491663?
The find_soa() function in dnsmasq is impacted by REDHAT-BUG-2491663.
How can I mitigate the effects of REDHAT-BUG-2491663?
Mitigation for REDHAT-BUG-2491663 can be achieved by applying appropriate patches or updates to dnsmasq once they are available.