Executive brief
Dnsmasq is a widely used tool that provides network infrastructure services like DNS and DHCP to local networks. A flaw in how it handles certain DNS responses could allow a remote attacker to read small amounts of sensitive data from the server's memory. While this is unlikely to cause a system crash, it could potentially expose information from previous network transactions.
Technical details
An out-of-bounds read exists in dnsmasq's find_soa() function within src/rfc1035.c. When parsing NS section records in NXDOMAIN or NODATA responses, the extract_name() function is called with extrabytes set to 0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields (type, class, TTL, and rdlen). A remote attacker controlling a DNS zone can exploit this by providing a crafted response where the record name extends to the packet boundary, causing GETSHORT/GETLONG macros to read 10 bytes past the valid packet buffer. This can result in the disclosure of stale data from prior DNS transactions. The issue is fixed in dnsmasq version 2.93rc1.
Affected products
- thekelleys.org.uk dnsmasq versions before 2.93rc1
- Red Hat Red Hat Enterprise Linux 10 affected
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory