Kevin Hamacher

**Nome do software vulnerável e versões afetadas** Linux (versões afetadas não especificadas) **Descrição** O problema é causado pelo tratamento inadequado das vmas VM IO|VM PFNMAP no KVM, o que pode contornar as verificações RO e levar à liberação de páginas enquanto estas ainda estão acessíveis pelo VMM e pelo sistema convidado. Isso permite que usuários com capacidade de iniciar e controlar uma VM leiam/gravem páginas aleatórias da memória, resultando em escalonamento de privilégios local. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to a memory leak that can be triggered when specific options such as `--add-mac`, `--add-cpe-id`, or `--add-subnet` are used. This allows remote attackers to cause a denial of service by consuming memory through vectors involving DNS response creation. **Recommendations** For dnsmasq versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the `--add-mac`, `--add-cpe-id`, and `--add-subnet` options until the update is applied.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is a heap-based buffer overflow that can be triggered by a crafted DNS response, allowing remote attackers to cause a denial of service or execute arbitrary code. This can occur due to a missing bounds check in the `do rfc1035 name` function of `util.c`, potentially leading to an out of bounds write. The exploitation of this issue does not require user interaction and can result in remote code execution, denial of service, or an out of memory situation. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting DNS response processing to minimize the risk of exploitation. Avoid using the `do rfc1035 name` function in `util.c` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dnsmasq versions prior to 2.78 **Description** The issue is caused by a heap-based buffer overflow in the dynamic memory of the DNS server. This can be exploited by a remote attacker using a specially crafted IPv6 request, potentially allowing them to cause a denial of service or execute arbitrary code. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to deficiencies in handling forwarded DHCPv6 requests, which can be exploited by a remote attacker to disclose sensitive information by injecting special elements into a command. This can allow remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 relay functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is caused by a stack-based buffer overflow in the DNS server. It can be exploited by a remote attacker using a specially crafted DHCPv6 request, potentially leading to a denial of service or the execution of arbitrary code. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is caused by an integer underflow in the `add pseudoheader` function of the Dnsmasq DNS server when the `--add-mac`, `--add-cpe-id`, or `--add-subnet` option is specified. This allows a remote attacker to cause a denial of service via a specially crafted DNS request. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider disabling the `add pseudoheader` function or avoiding the use of the `--add-mac`, `--add-cpe-id`, or `--add-subnet` options until a patch is available.