CVE-2020-25681
📋 TL;DR
This vulnerability is a heap-based buffer overflow in dnsmasq before version 2.83 that occurs during DNSSEC validation of RRSets. An attacker who can forge DNS replies could exploit this to execute arbitrary code on affected systems. Any system running vulnerable dnsmasq versions with DNSSEC enabled is affected.
💻 Affected Systems
- dnsmasq
📦 What is this software?
Dnsmasq by Thekelleys
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Denial of service through dnsmasq crash, potentially disrupting DNS resolution for dependent systems.
If Mitigated
Limited impact if DNSSEC is disabled or if network controls prevent DNS reply forgery.
🎯 Exploit Status
Exploitation requires ability to forge DNS replies that pass initial validation and trigger the buffer overflow during DNSSEC processing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.83 and later
Vendor Advisory: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2020q4/014599.html
Restart Required: Yes
Instructions:
1. Update dnsmasq to version 2.83 or later using your distribution's package manager. 2. For Red Hat/Fedora: 'sudo dnf update dnsmasq'. 3. For Debian/Ubuntu: 'sudo apt update && sudo apt install dnsmasq'. 4. Restart dnsmasq service: 'sudo systemctl restart dnsmasq'.
🔧 Temporary Workarounds
Disable DNSSEC validation
linuxTemporarily disable DNSSEC validation to prevent exploitation while patching.
Edit /etc/dnsmasq.conf and remove or comment out 'dnssec' line
Restart dnsmasq: sudo systemctl restart dnsmasq
🧯 If You Can't Patch
- Disable DNSSEC validation in dnsmasq configuration
- Implement network segmentation to restrict who can send DNS replies to dnsmasq
🔍 How to Verify
Check if Vulnerable:
Check dnsmasq version: 'dnsmasq --version' or 'dpkg -l dnsmasq' or 'rpm -q dnsmasq'. If version is below 2.83 and DNSSEC is enabled, system is vulnerable.Check Version:
dnsmasq --version | head -1Verify Fix Applied:
Confirm version is 2.83 or higher: 'dnsmasq --version | head -1'. Verify dnsmasq is running: 'systemctl status dnsmasq'.📡 Detection & Monitoring
Log Indicators:
- dnsmasq crash logs in systemd journal
- Segmentation fault errors in dnsmasq logs
- Unexpected dnsmasq restarts
Network Indicators:
- Unusual DNS traffic patterns to dnsmasq port 53
- Suspicious DNSSEC validation requests
SIEM Query:
process_name:dnsmasq AND (event_type:crash OR exit_code:139 OR signal:SIGSEGV)🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1881875
- https://lists.debian.org/debian-lts-announce/2021/03/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/
- https://security.gentoo.org/glsa/202101-17
- https://www.debian.org/security/2021/dsa-4844
- https://www.jsof-tech.com/disclosures/dnspooq/
- https://bugzilla.redhat.com/show_bug.cgi?id=1881875
- https://lists.debian.org/debian-lts-announce/2021/03/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/
- https://security.gentoo.org/glsa/202101-17
- https://www.debian.org/security/2021/dsa-4844
- https://www.jsof-tech.com/disclosures/dnspooq/
- https://www.kb.cert.org/vuls/id/434904
