Description
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dnsmasq | 2.78-1 | — |
| Debian 13 | dnsmasq | 2.78-1 | — |
| Debian 12 | dnsmasq | 2.78-1 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dnsmasq | 2.78-r0 | — |
| Alpine v3.23 | dnsmasq | 2.78-r0 | — |
| Alpine v3.22 | dnsmasq | 2.78-r0 | — |
| Alpine v3.21 | dnsmasq | 2.78-r0 | — |
| Alpine v3.20 | dnsmasq | 2.78-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | dnsmasq | 2.78-r0 | — |
| Alpine v3.18 | dnsmasq | 2.78-r0 | — |
| Alpine v3.17 | dnsmasq | 2.78-r0 | — |
| Alpine v3.16 | dnsmasq | 2.78-r0 | — |
| Alpine v3.15 | dnsmasq | 2.78-r0 | — |
| Alpine v3.14 | dnsmasq | 2.78-r0 | — |
| Alpine v3.13 | dnsmasq | 2.78-r0 | — |
| Alpine v3.12 | dnsmasq | 2.78-r0 | — |
| Alpine v3.11 | dnsmasq | 2.78-r0 | — |
| Alpine v3.10 | dnsmasq | 2.78-r0 | — |
| Alpine v3.9 | dnsmasq | 2.78-r0 | — |
| Alpine v3.8 | dnsmasq | 2.78-r0 | — |
| Alpine v3.7 | dnsmasq | 2.78-r0 | — |
Advisories 1
- ICSA-17-332-01 Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C) CISA ICS & IT advisories · May 9, 2018
References
- 1039474 vdb-entry
- https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq
- https://access.redhat.com/security/vulnerabilities/3199382
- 101085 vdb-entry
- 101977 vdb-entry
- FEDORA-2017-274d763ed8 vendor-advisory
- [dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78. mailing-list
- http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=63437ffbb58837b214b4b92cb1c54bc5f3279928
- http://thekelleys.org.uk/dnsmasq/CHANGELOG
- https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html
- [dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION. mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf