Bug 1495411 – CVE-2017-14493 dnsmasq: stack buffer overflow in the DHCPv6 code

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1495411 - (CVE-2017-14493) CVE-2017-14493 dnsmasq: stack buffer overflow in the DHCPv6 code

Summary:	CVE-2017-14493 dnsmasq: stack buffer overflow in the DHCPv6 code

Status:	CLOSED ERRATA

Aliases:	CVE-2017-14493

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	urgent Severity urgent
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=critical,public=20171002,repor...
Keywords:	Security

Depends On:	1495516 1495517 1496264 1496265 1497691
Blocks:	1495418
	Show dependency tree / graph

Reported:	2017-09-25 21:50 EDT by Fabio Olive Leite
Modified:	2018-04-17 21:49 EDT (History)
CC List:	23 users (show)

See Also:
Fixed In Version:	dnsmasq 2.78
Doc Type:	If docs needed, set a value
Doc Text:	A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-10-02 14:16:05 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Upstream commit (1.45 KB, patch) 2017-09-26 06:47 EDT, Tomas Hoger	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:2836	normal	SHIPPED_LIVE	Critical: dnsmasq security update	2017-10-02 17:18:46 EDT
Red Hat Product Errata	RHSA-2017:2837	normal	SHIPPED_LIVE	Critical: dnsmasq security update	2017-10-02 16:19:55 EDT

Groups: None (edit)

Description Fabio Olive Leite 2017-09-25 21:50:15 EDT

Red Hat Product Security has been made aware of a stack-based buffer overflow affecting the DHCP implementation of dnsmasq.

Comment 1 Doran Moppert 2017-09-26 01:11:57 EDT

Acknowledgments:

Name: Felix Wilhelm (Google Security Team), Fermin J. Serna (Google Security Team), Gabriel Campana (Google Security Team), Kevin Hamacher (Google Security Team), Ron Bowes (Google Security Team)

Comment 2 Doran Moppert 2017-09-26 04:42:36 EDT

Versions of dnsmasq shipped with Red Hat Enterprise Linux 6 and 5 do not include the DHCPv6 code which includes this flaw.

Comment 3 Tomas Hoger 2017-09-26 04:48:05 EDT

Further details from the 2.78 pre-release CHANGELOG:

    Fix stack overflow in DHCPv6 code. An attacker who can send
    a DHCPv6 request to dnsmasq can overflow the stack frame and
    crash or control dnsmasq.
    CVE-2017-14493 applies.
    Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
    and Kevin Hamacher of the Google Security Team for
    finding this.

Comment 5 Tomas Hoger 2017-09-26 06:47 EDT

Created attachment 1330991 [details]
Upstream commit

Comment 10 Adam Mariš 2017-10-02 09:14:23 EDT

External References:

https://access.redhat.com/security/vulnerabilities/3199382
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html

Comment 11 Adam Mariš 2017-10-02 09:19:19 EDT

Created dnsmasq tracking bugs for this issue:

Affects: fedora-all [bug 1497691]

Comment 12 Tomas Hoger 2017-10-02 09:42:45 EDT

Upstream commit:

http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=3d4ff1ba8419546490b464418223132529514033

Google Security Team's repository with test cases:

https://github.com/google/security-research-pocs/tree/master/vulnerabilities/dnsmasq

Comment 13 errata-xmlrpc 2017-10-02 12:23:37 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Extended Update Support
  Red Hat Enterprise Linux 7.3 Extended Update Support

Via RHSA-2017:2837 https://access.redhat.com/errata/RHSA-2017:2837

Comment 14 errata-xmlrpc 2017-10-02 13:20:39 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2836 https://access.redhat.com/errata/RHSA-2017:2836

Comment 15 Garth Mollett 2017-10-03 16:57:20 EDT

Statement:

Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw's affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.

However, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as 'yum update' or 'openstack overcloud update').

Note You need to log in before you can comment on or make changes to this bug.

apevec
chrisw
gmollett
itamar
jjoyce
jschluet
kbasil
laine
lhh
lpeer
markmc
mburns
pavlix
p
pemensik
rbryant
sclewis
security-response-team
slinaber
srevivo
tdecacqu
thozza
veillard