CVE-2020-25681

HIGH EPSS 99.6%
Published Jan 20, 20215y ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published Jan 20, 2021 5y ago
Last Modified Jun 17, 2026 1w ago

Description

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS Details

Base Score
8.1
Exploitability
2.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
99.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-122

Affected Products 5

VendorProductVersionRange
thekelleysdnsmasq* <2.83
fedoraprojectfedora32any
fedoraprojectfedora33any
debiandebian_linux9.0any
debiandebian_linux10.0any

References 8

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1881875
    Issue TrackingPatchThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2021/03/msg00027.html
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/
  • security.gentoo.org https://security.gentoo.org/glsa/202101-17
    Third Party Advisory
  • debian.org https://www.debian.org/security/2021/dsa-4844
    Third Party Advisory
  • jsof-tech.com https://www.jsof-tech.com/disclosures/dnspooq/
    Third Party Advisory
  • kb.cert.org https://www.kb.cert.org/vuls/id/434904

Remediation

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1881875
    Issue TrackingPatchThird Party Advisory