PT-2026-39648 · Dnsmasq+3 · Dnsmasq+3
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
dnsmasq versions 2.73 through 2.92
Description
A heap buffer overflow exists in the DNS cache when processing DNS responses. The
extract name() function can be abused because the software expands certain characters into longer escape sequences without ensuring the cache buffer is sized to hold the expanded result. Specifically, an unsafe strcpy() in the really insert() function within src/cache.c copies attacker-controlled name strings without bounds validation, overflowing a 1,025-byte bigname cache buffer. An attacker can exploit this by using a malicious upstream DNS server and crafted CNAME chains to corrupt memory, potentially leading to remote code execution, DNS cache poisoning to redirect lookups to attacker-controlled IP addresses, or a denial of service (DoS).Recommendations
Update dnsmasq to version 2.92rel2 or 2.93.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Rocky Linux
Ubuntu
Dnsmasq