Bug 1495510 (CVE-2017-13704)

Summary:	CVE-2017-13704 dnsmasq: Size parameter overflow via large DNS query
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	apevec, carnil, chrisw, code, itamar, jjoyce, jschluet, kbasil, laine, lhh, lpeer, markmc, mburns, p, pemensik, rbryant, sclewis, slinaber, srevivo, tdecacqu, thozza, veillard
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dnsmasq 2.78	Doc Type:	If docs needed, set a value
Doc Text:	An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the DNS code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-29 05:09:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1495418

Description Andrej Nemec 2017-09-26 08:37:45 UTC

It was found that if a DNS query request (qlen) is either larger than 512, or includes an EDNS0 packet size field, and the request is larger than what it specifies, then the size parameter to memset will overflow and become negative. An attacker could use this for a remote denial of service attack.

References:

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2017q3/011729.html

Upstream patch:

http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=63437ffbb58837b214b4b92cb1c54bc5f3279928

Comment 1 Tomas Hoger 2017-09-26 08:40:59 UTC

Upstream CHANGELOG notes this issue is a regression introduced in dnsmasq version  2.77 and is getting fixed in version 2.78.