Vulnerability record · CVE-2020-25682 · published 20 January 2021
CVE-2020-25682: dnsmasq DNS packet name extraction heap buffer overflow
Thekelleys · Dnsmasq
dnsmasq before 2.83 has a heap-based buffer overflow in rfc1035.c:extract_name(), which writes to the buffer pointed to by name assuming MAXDNAME*2 bytes are available. On some code paths extract_name() receives an offset from the base buffer, so fewer bytes are actually writable, letting a crafted DNS reply overflow heap memory with arbitrary data. The flaw affects confidentiality, integrity and availability of the resolver and any service relying on it.
Description
A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.1 with network reachability and high confidentiality, integrity and availability impact, plus a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
dnsmasq before 2.83 has a heap-based buffer overflow in rfc1035.c:extract_name(), which writes to the buffer pointed to by name assuming MAXDNAME*2 bytes are available. On some code paths extract_name() receives an offset from the base buffer, so fewer bytes are actually writable, letting a crafted DNS reply overflow heap memory with arbitrary data. The flaw affects confidentiality, integrity and availability of the resolver and any service relying on it.
Impact
An attacker who can supply valid DNS replies can corrupt heap memory with controlled data, potentially achieving code execution on the machine running dnsmasq. At minimum this yields denial of service and possible disclosure or modification of data handled by the resolver.
Attack surface
Reached over the network by sending crafted DNS responses to a dnsmasq instance that processes them, as reflected by AV:N with no privileges or user interaction required (PR:N/UI:N). The high attack complexity (AC:H) reflects the need to craft replies that reach the vulnerable extraction path.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.70754, 99.4th percentile), indicating elevated likelihood of exploitation activity. References include patch and advisory links plus the public DNSPooq disclosure, but no exploit code is cited in the record.
What to do
- Upgrade dnsmasq to 2.83 or later, or apply the vendor patch referenced in the Red Hat bug and distribution advisories.
- Apply the Debian, Fedora and Gentoo package updates for the affected releases.
- Restrict which networks and hosts can send DNS replies to dnsmasq instances, and avoid exposing the resolver to untrusted networks where possible.
- Run dnsmasq with least privilege and enable available memory-safety hardening (for example, compiler and allocator protections) on the host.
- Monitor vendor advisories for updated packages and re-verify version after patching.
Detection
- Check dnsmasq version on all resolvers and flag any instance below 2.83.
- Monitor dnsmasq process crashes, restarts or abnormal memory growth that could indicate malformed DNS reply handling.
- Inspect DNS traffic for unusually large or malformed name fields in responses reaching dnsmasq.
- Review host and package inventory for dnsmasq deployments on Debian, Fedora and Gentoo systems and confirm patch status.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-25682 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-25682), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
