Heap-based buffer overflow in Dnsmasq - CVE-2020-25681

Vulnerability identifier: #VU49840

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25681

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in "sort_rrset()" when DNSSEC is used. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Dnsmasq
Arch Linux
Gentoo Linux
Oracle Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Slackware Linux
Ubuntu
openEuler
Fedora
AWK-1137C Series
AWK-4131A
AWK-1131A Series
AWK-3131A Series
Dell EMC VxRail Appliance
dnsmasq (Debian package)
dnsmasq (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
dnsmasq-utils (Ubuntu package)
dnsmasq-base (Ubuntu package)
dnsmasq (Ubuntu package)
dnsmasq (Red Hat package)
dnsmasq
dnsmasq-debuginfo
dnsmasq-debugsource
dnsmasq-help

Install updates from vendor's website.

Dnsmasq - update to 2.83
AWK-1137C Series - update to 1.7
AWK-3131A Series - update to 1.17
AWK-4131A - update to 1.17
AWK-1131A Series - update to 1.23
dnsmasq (Debian package) - update to 2.80-1+deb10u1
dnsmasq (Alpine package) - update to 2.83-r0
dnsmasq-utils (Ubuntu package) - addressed in versions 2.75-1ubuntu0.16.04.7, 2.75-1ubuntu0.16.04.8, 2.79-1ubuntu0.2, 2.79-1ubuntu0.3, 2.80-1.1ubuntu1.2, 2.80-1.1ubuntu1.3, 2.82-1ubuntu1.1, 2.82-1ubuntu1.2
dnsmasq-base (Ubuntu package) - addressed in versions 2.75-1ubuntu0.16.04.7, 2.75-1ubuntu0.16.04.8, 2.79-1ubuntu0.2, 2.79-1ubuntu0.3, 2.80-1.1ubuntu1.2, 2.80-1.1ubuntu1.3, 2.82-1ubuntu1.1, 2.82-1ubuntu1.2
dnsmasq (Ubuntu package) - addressed in versions 2.75-1ubuntu0.16.04.7, 2.75-1ubuntu0.16.04.8, 2.79-1ubuntu0.2, 2.79-1ubuntu0.3, 2.80-1.1ubuntu1.2, 2.80-1.1ubuntu1.3, 2.82-1ubuntu1.1, 2.82-1ubuntu1.2
dnsmasq (Red Hat package) - addressed in versions 2.79-6.el8_1.1, 2.79-11.el8_2.2, 2.79-13.el8_3.1
dnsmasq - update to 2.82-4
dnsmasq-debuginfo - update to 2.82-4
dnsmasq-debugsource - update to 2.82-4
dnsmasq-help - update to 2.82-4
dnsmasq - addressed in versions 2.83-1.fc33, 2.84-1.fc32
Dell EMC VxRail Appliance - update to 7.0.240

• https://ics-cert.us-cert.gov/advisories/icsa-21-019-01
• https://www.jsof-tech.com/disclosures/dnspooq/

• Multiple vulnerabilities in Dnsmasq
• Heap-based buffer overflow in dnsmasq (Alpine package)
• Red Hat Enterprise Linux 8.2 update for dnsmasq
• Red Hat Enterprise Linux 8.1 update for dnsmasq
• Red Hat Enterprise Linux 8 update for dnsmasq
• Arch Linux update for dnsmasq
• Gentoo update for Dnsmasq
• Debian update for dnsmasq
• Slackware Linux update for dnsmasq
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Moxa AWK-3131A/4131A/1137C/1131A devices update for dnsmasq
• Ubuntu update for dnsmasq
• Ubuntu update for dnsmasq
• Multiple vulnerabilities in Oracle Linux
• openEuler update for dnsmasq
• Fedora 33 update for dnsmasq
• Fedora 32 update for dnsmasq