CVE-2021-45955 — CRITICAL (9.8)

Vulnerability Description

Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c) because of the lack of a proper bounds check upon pseudo header re-insertion. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge." However, a contributor states that a security patch (mentioned in 016162.html) is needed

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Thekelleys	Dnsmasq	2.86

Related Weaknesses (CWE)

CWE-787

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35898ExploitIssue TrackingThird Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-932.yaThird Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.htmlMailing ListThird Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.htmlMailing ListThird Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35898ExploitIssue TrackingThird Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/dnsmasq/OSV-2021-932.yaThird Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016162.htmlMailing ListThird Party Advisory
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016164.htmlMailing ListThird Party Advisory

FAQ

What is CVE-2021-45955?

CVE-2021-45955 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c) because of the lack of a proper bounds check upon pseudo header re-insertion. NOTE: the...

How severe is CVE-2021-45955?

CVE-2021-45955 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-45955?

Check the references section above for vendor advisories and patch information. Affected products include: Thekelleys Dnsmasq.