CVE-2023-49441
📋 TL;DR
CVE-2023-49441 is an integer overflow vulnerability in dnsmasq's forward_query function that could allow remote attackers to cause a denial of service or potentially execute arbitrary code. This affects dnsmasq 2.9 installations that forward DNS queries. Organizations using dnsmasq as a DNS forwarder or DHCP server are at risk.
💻 Affected Systems
- dnsmasq
📦 What is this software?
Dnsmasq by Thekelleys
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise and potential lateral movement within the network.
Likely Case
Denial of service causing DNS resolution failures and disruption of network services.
If Mitigated
Limited impact with proper network segmentation and exploit mitigations in place.
🎯 Exploit Status
Exploitation requires sending specially crafted DNS queries to trigger the integer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 65c2d6afd67a032f45f40d7e4d620f5d73e5f07d and later versions
Vendor Advisory: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q4/017332.html
Restart Required: Yes
Instructions:
1. Update dnsmasq to the latest version from your distribution's repositories. 2. For source installations, apply the patch from the official git repository. 3. Restart the dnsmasq service.
🔧 Temporary Workarounds
Disable DNS forwarding
linuxConfigure dnsmasq to operate only as a DHCP server without DNS forwarding capabilities
Edit /etc/dnsmasq.conf and remove or comment out 'server=' lines
Set 'no-resolv' and 'no-poll' options
Network filtering
linuxRestrict access to dnsmasq DNS port (53) to trusted sources only
iptables -A INPUT -p udp --dport 53 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s trusted_network -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate dnsmasq instances from untrusted networks
- Deploy intrusion detection/prevention systems to monitor for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check dnsmasq version: dnsmasq --version | head -1. If it shows version 2.9, you are vulnerable.Check Version:
dnsmasq --version | head -1Verify Fix Applied:
After patching, verify the version is no longer 2.9 and check that dnsmasq runs without errors when forwarding queries.📡 Detection & Monitoring
Log Indicators:
- Unexpected dnsmasq crashes or restarts
- High volume of malformed DNS queries
- Error messages related to memory allocation or integer overflow
Network Indicators:
- Unusual DNS query patterns to dnsmasq instances
- DNS queries with abnormally large payloads
SIEM Query:
source="dnsmasq" AND ("segmentation fault" OR "crash" OR "overflow")🔗 References
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q4/017332.html
- https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=65c2d6afd67a032f45f40d7e4d620f5d73e5f07d
- https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q4/017332.html
- https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=65c2d6afd67a032f45f40d7e4d620f5d73e5f07d
