Vulnerability record · CVE-2020-25683 · published 20 January 2021
CVE-2020-25683: dnsmasq DNSSEC heap buffer overflow via extract_name length checks
Thekelleys · Dnsmasq
dnsmasq before 2.83 has a heap-based buffer overflow in rfc1035.c:extract_name() when DNSSEC is enabled and before received DNS entries are validated. Missing length checks let a crafted reply drive memcpy() with a negative size in get_rdata(), crashing dnsmasq. The main threat is loss of availability for DNS resolution on affected hosts.
Description
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityThe flaw is remotely reachable without authentication and causes denial of service, and EPSS is very high, though CVSS is only medium and exploitation is not confirmed in KEV.
What it is
dnsmasq before 2.83 has a heap-based buffer overflow in rfc1035.c:extract_name() when DNSSEC is enabled and before received DNS entries are validated. Missing length checks let a crafted reply drive memcpy() with a negative size in get_rdata(), crashing dnsmasq. The main threat is loss of availability for DNS resolution on affected hosts.
Impact
An attacker who can supply a valid-looking DNS reply can crash the dnsmasq process, causing denial of service for DNS resolution and any services relying on it. The record describes availability impact only; no confidentiality or integrity impact is stated.
Attack surface
Reachable remotely over the network via DNS replies when DNSSEC is enabled; no authentication or user interaction is required per the CVSS vector (AV:N/AC:H/PR:N/UI:N). The high attack complexity reflects the need to craft a reply that passes enough checks to reach the vulnerable code path.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high (0.86041, 99.7th percentile), and references include a patch and the DNSPooq disclosure, indicating public technical detail exists, but the record does not confirm in-the-wild exploitation.
What to do
- Upgrade dnsmasq to version 2.83 or later, or apply the vendor patch referenced in the Red Hat bug and distribution advisories.
- Apply the Debian, Fedora and Gentoo security updates for dnsmasq on affected systems.
- If patching is delayed, disable DNSSEC validation in dnsmasq to avoid the vulnerable code path, accepting the loss of DNSSEC protection.
- Restrict DNS resolver exposure to trusted networks and clients where feasible to reduce the pool of attackers able to send crafted replies.
Detection
- Monitor dnsmasq process crashes or restarts and correlate them with DNS query volume or unusual upstream responses.
- Alert on dnsmasq logs showing DNSSEC validation errors or malformed reply handling around the time of service interruptions.
- Track DNS response sizes and patterns from upstream resolvers for anomalies that could indicate crafted replies targeting extract_name().
- Use host or network monitoring to detect repeated dnsmasq availability loss on systems with DNSSEC enabled.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-25683 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-25683), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
