CVE-2021-45955 – CVE-2021-45955 is a heap-based buffer overflow ... (How to Fix)

📋 TL;DR

CVE-2021-45955 is a heap-based buffer overflow vulnerability in Dnsmasq 2.86 that occurs during DNS packet resizing due to insufficient bounds checking. This could allow remote attackers to execute arbitrary code or cause denial of service. Organizations running Dnsmasq 2.86 for DNS caching or DHCP services are affected.

💻 Affected Systems

Products:

Dnsmasq

Versions: Version 2.86 specifically

Operating Systems: Linux, BSD, Embedded systems using Dnsmasq

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the DNS packet handling code, so any Dnsmasq configuration with DNS functionality enabled is vulnerable. The vendor disputes this is a real vulnerability, but patches exist.

📦 What is this software?

Dnsmasq by Thekelleys

View all CVEs affecting Dnsmasq →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with root privileges leading to complete system compromise, data exfiltration, or persistent backdoor installation.

🟠

Likely Case

Denial of service causing DNS/DHCP service disruption, potentially affecting network connectivity for dependent systems.

🟢

If Mitigated

Limited impact with proper network segmentation and exploit mitigations; service disruption but no privilege escalation.

🌐 Internet-Facing: HIGH - Dnsmasq often serves as DNS forwarder/cache exposed to untrusted DNS queries from the internet.

🏢 Internal Only: MEDIUM - Internal DNS/DHCP servers could be exploited by compromised internal hosts or malicious insiders.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Proof-of-concept exists in oss-fuzz reports. Exploitation requires sending specially crafted DNS packets but no authentication. The heap-based nature makes reliable exploitation moderately complex.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 2.86 (2.87+)

Vendor Advisory: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html

Restart Required: Yes

Instructions:

1. Check current Dnsmasq version: dnsmasq --version
2. Update via package manager: apt-get update && apt-get upgrade dnsmasq (Debian/Ubuntu) or yum update dnsmasq (RHEL/CentOS)
3. Verify upgrade: dnsmasq --version
4. Restart service: systemctl restart dnsmasq

🔧 Temporary Workarounds

Disable DNS functionality

linux

Configure Dnsmasq to only provide DHCP services without DNS resolution

Edit /etc/dnsmasq.conf and set: port=0
Restart: systemctl restart dnsmasq

Network filtering

linux

Restrict DNS queries to trusted sources only using firewall rules

iptables -A INPUT -p udp --dport 53 -s trusted_network -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to isolate Dnsmasq servers from untrusted networks
Deploy exploit mitigation technologies like ASLR, stack canaries, and control flow integrity

🔍 How to Verify

Check if Vulnerable:

Check if running Dnsmasq 2.86: dnsmasq --version | grep 'version 2.86'

Check Version:

dnsmasq --version | head -1

Verify Fix Applied:

Confirm version is 2.87 or higher: dnsmasq --version | grep -v 'version 2.86'

📡 Detection & Monitoring

Log Indicators:

Multiple malformed DNS packet errors in Dnsmasq logs
Unexpected process crashes or restarts of dnsmasq service

Network Indicators:

Unusual DNS queries with malformed packet structures
DNS traffic from unexpected sources to port 53

SIEM Query:

source="dnsmasq" AND (error OR crash OR "malformed packet")

📊 Metadata

CVE ID: CVE-2021-45955

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: January 1, 2022

Last Updated: November 21, 2024

🔗 References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35898 Exploit,Issue Tracking,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-932.yaml Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html Mailing List,Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.html Mailing List,Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35898 Exploit,Issue Tracking,Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-932.yaml Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.html Mailing List,Third Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.html Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-45955, you might also want to check these: