CVE-2021-45953 – CVE-2021-45953 is a heap-based buffer overflow ... (How to Fix)

Q: What is the severity of CVE-2021-45953?

CVE-2021-45953 has a CVSS score of 9.8 (CRITICAL). CVE-2021-45953 is a heap-based buffer overflow vulnerability in Dnsmasq 2.86's extract_name function that could allow remote code execution or denial of service. Systems running Dnsmasq 2.86 as a DNS server are affected. Note that the vendor disputes this represents a real vulnerability.

📋 TL;DR

CVE-2021-45953 is a heap-based buffer overflow vulnerability in Dnsmasq 2.86's extract_name function that could allow remote code execution or denial of service. Systems running Dnsmasq 2.86 as a DNS server are affected. Note that the vendor disputes this represents a real vulnerability.

💻 Affected Systems

Products:

Dnsmasq

Versions: Version 2.86 only

Operating Systems: Linux, BSD, Other Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems where Dnsmasq is configured to handle DNS queries. The vendor disputes this is a real vulnerability.

📦 What is this software?

Dnsmasq by Thekelleys

View all CVEs affecting Dnsmasq →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote attacker executes arbitrary code with Dnsmasq process privileges, potentially gaining full system control.

🟠

Likely Case

Denial of service causing DNS service disruption and potential system crashes.

🟢

If Mitigated

Limited impact with proper network segmentation and exploit mitigations like ASLR.

🌐 Internet-Facing: HIGH - Dnsmasq often runs on internet-facing DNS servers, making them directly accessible to attackers.

🏢 Internal Only: MEDIUM - Internal DNS servers could be targeted by compromised internal hosts.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Proof-of-concept available through OSS-Fuzz reports. Exploitation requires sending specially crafted DNS queries.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 2.87 and later

Vendor Advisory: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html

Restart Required: Yes

Instructions:

1. Download Dnsmasq 2.87 or later from official repository. 2. Stop Dnsmasq service. 3. Install new version. 4. Restart Dnsmasq service.

🔧 Temporary Workarounds

Network filtering

linux

Block external DNS queries to Dnsmasq using firewall rules

iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

Disable DNS functionality

linux

Configure Dnsmasq to only provide DHCP services if DNS is not required

Edit /etc/dnsmasq.conf and set 'port=0'

🧯 If You Can't Patch

Implement strict network segmentation to isolate Dnsmasq servers
Enable exploit mitigations like ASLR and DEP on the host system

🔍 How to Verify

Check if Vulnerable:

Check Dnsmasq version: dnsmasq --version | head -1

Check Version:

dnsmasq --version | head -1

Verify Fix Applied:

Verify version is 2.87 or higher: dnsmasq --version | grep -q 'version 2\.8[7-9]\|version 2\.[9-9]' && echo 'Patched'

📡 Detection & Monitoring

Log Indicators:

Multiple malformed DNS query errors
Dnsmasq process crashes or restarts

Network Indicators:

Unusual DNS query patterns with malformed names
Traffic spikes to port 53

SIEM Query:

source="dnsmasq" AND (error OR crash OR "malformed")

📊 Metadata

CVE ID: CVE-2021-45953

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: January 1, 2022

Last Updated: November 21, 2024

🔗 References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35858 Exploit,Issue Tracking,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-929.yaml Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html Mailing List,Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.html Mailing List,Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35858 Exploit,Issue Tracking,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-929.yaml Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html Mailing List,Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.html Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-45953, you might also want to check these: