Bug 2406465 (CVE-2025-12200)

Summary: CVE-2025-12200 dnsmasq: dnsmasq Config File option.c parse_dhcp_opt null pointer dereference
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A NULL pointer dereference vulnerability in dnsmasq, located in the function parse_dhcp_opt() (src/option.c). When parsing a malformed or empty OPTION_SIP_SERVER configuration value, the temporary buffer m remains uninitialized (NULL). The code later unconditionally performs m[0] = 0, resulting in a write to the null address and causing a segmentation fault during startup. This leads to a Denial of Service (DoS) condition, preventing dnsmasq from launching. The issue can be exploited locally by supplying a crafted dnsmasq.conf file.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-27 02:01:41 UTC 
A vulnerability was determined in dnsmasq up to 2.73rc6. Affected by this issue is the function parse_dhcp_opt of the file src/option.c of the component Config File Handler. This manipulation of the argument m causes null pointer dereference. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.