Vulnerability record · CVE-2020-25681 · published 20 January 2021
CVE-2020-25681: dnsmasq DNSSEC RRSet sorting heap buffer overflow
Thekelleys · Dnsmasq
dnsmasq before 2.83 contains a heap-based buffer overflow in the code that sorts RRSets before DNSSEC validation. An attacker on the network who can forge DNS replies that are accepted as valid can overflow heap memory with arbitrary data, potentially leading to code execution. The flaw affects confidentiality, integrity and availability of the host running dnsmasq.
Description
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.1 with high confidentiality, integrity and availability impact and a very high EPSS score, though exploitation requires the harder condition of forged replies being accepted as valid and no KEV listing exists.
What it is
dnsmasq before 2.83 contains a heap-based buffer overflow in the code that sorts RRSets before DNSSEC validation. An attacker on the network who can forge DNS replies that are accepted as valid can overflow heap memory with arbitrary data, potentially leading to code execution. The flaw affects confidentiality, integrity and availability of the host running dnsmasq.
Impact
An attacker able to inject forged DNS responses can corrupt heap memory with attacker-controlled data, potentially achieving remote code execution on the dnsmasq host. Even without code execution, the overflow can crash or destabilize the resolver, affecting availability.
Attack surface
Reachable over the network via DNS traffic (AV:N) with no privileges or user interaction required (PR:N, UI:N), but exploitation requires conditions that make forged replies accepted as valid, reflected in the high attack complexity (AC:H). The vulnerable path is DNSSEC validation of sorted RRSets, so deployments using DNSSEC are the relevant exposure.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.812, ~99.6th percentile), indicating strong predicted exploitation likelihood. References include a vendor patch and the public DNSPooq disclosure, but the record does not state that a working exploit is publicly available.
What to do
- Upgrade dnsmasq to version 2.83 or later; apply the vendor patch referenced in the Red Hat bug and distribution advisories.
- Apply the Debian, Fedora and Gentoo security updates for affected packages.
- Restrict DNS resolver exposure to trusted networks and clients where possible, reducing the pool of attackers able to inject forged replies.
- Where DNSSEC validation is not required, consider disabling it to remove the vulnerable code path, and monitor vendor guidance.
- Track upstream dnsmasq releases and re-check for follow-up fixes to the DNSSEC RRSet handling.
Detection
- Monitor dnsmasq process crashes, restarts or abnormal termination, which may indicate a triggered heap overflow.
- Watch for memory corruption indicators in dnsmasq logs or host-level crash dumps and core files.
- Hunt for anomalous or spoofed DNS response patterns reaching resolvers, especially responses that pass DNSSEC validation unexpectedly.
- Audit dnsmasq versions across the estate to identify hosts still running releases before 2.83.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-25681 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-25681), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
