CVE-2021-45951 – CVE-2021-45951 is a heap-based buffer overflow ... (How to Fix)

📋 TL;DR

CVE-2021-45951 is a heap-based buffer overflow vulnerability in Dnsmasq 2.86's check_bad_address function that could allow remote code execution or denial of service. Systems running Dnsmasq 2.86 as a DNS resolver or DHCP server are affected. The vendor disputes this is a real vulnerability, but the CVSS score suggests high risk.

💻 Affected Systems

Products:

Dnsmasq

Versions: Version 2.86 specifically

Operating Systems: Linux, BSD, Other Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Dnsmasq 2.86. The vendor disputes this is a real vulnerability despite the CVE assignment.

📦 What is this software?

Dnsmasq by Thekelleys

View all CVEs affecting Dnsmasq →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote attacker executes arbitrary code with root privileges, potentially compromising the entire system and network.

🟠

Likely Case

Denial of service causing DNS/DHCP service disruption, potentially affecting network connectivity for clients.

🟢

If Mitigated

Limited impact if Dnsmasq runs in chroot/jail or with privilege separation, though service disruption still possible.

🌐 Internet-Facing: HIGH if Dnsmasq is exposed to untrusted networks as a DNS resolver.

🏢 Internal Only: MEDIUM if only internal clients can trigger the vulnerability, but still poses risk to network infrastructure.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specially crafted DNS queries. No public exploits known, but the vulnerability is remotely triggerable.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 2.87 or later

Vendor Advisory: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html

Restart Required: Yes

Instructions:

1. Check current version: dnsmasq --version
2. Update via package manager: apt-get update && apt-get upgrade dnsmasq (Debian/Ubuntu) or yum update dnsmasq (RHEL/CentOS)
3. Verify version: dnsmasq --version
4. Restart service: systemctl restart dnsmasq

🔧 Temporary Workarounds

Restrict DNS queries

linux

Limit which clients can query the DNS server to reduce attack surface

Add to dnsmasq.conf: local-service
Add to dnsmasq.conf: bind-interfaces
Add to dnsmasq.conf: listen-address=<trusted_ip>

Run with reduced privileges

linux

Run Dnsmasq in chroot or with user namespace isolation

Add to dnsmasq.conf: user=nobody
Add to dnsmasq.conf: group=nogroup
Use systemd's DynamicUser=yes

🧯 If You Can't Patch

Implement network segmentation to isolate Dnsmasq from untrusted networks
Deploy intrusion detection/prevention systems to monitor for anomalous DNS traffic patterns

🔍 How to Verify

Check if Vulnerable:

Run: dnsmasq --version | grep 'version 2.86'

Check Version:

dnsmasq --version | head -1

Verify Fix Applied:

Run: dnsmasq --version | grep -v 'version 2.86' && echo 'Not vulnerable'

📡 Detection & Monitoring

Log Indicators:

Unusual DNS query patterns
Dnsmasq crash logs
Memory corruption warnings in system logs

Network Indicators:

Anomalous DNS queries with malformed addresses
Traffic spikes to port 53/UDP

SIEM Query:

source="dnsmasq" AND ("segmentation fault" OR "buffer overflow" OR "crash")

📊 Metadata

CVE ID: CVE-2021-45951

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: January 1, 2022

Last Updated: November 21, 2024

🔗 References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35868 Exploit,Issue Tracking,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-924.yaml Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html Mailing List,Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.html Mailing List,Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35868 Exploit,Issue Tracking,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-924.yaml Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html Mailing List,Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.html Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-45951, you might also want to check these: