Skip to content
Fencer Vulns
high 8.1

CVE-2020-25682 in the critical feed json

A flaw was found in dnsmasq before 2.83.

published 2021-01-20 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-18344

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
75.1%
EPSS 75.1% chance of exploitation in 30 days, percentile 99.5%
public exploits
0
none known

Summary

A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

  • thekelleys dnsmasq 2.83
  • dnsmasq Debian 14, Debian 13, Debian 12 2.83-1

debian advisories DEBIAN-CVE-2020-25682

  • dnsmasq Ubuntu 16.04 LTS 2.75-1ubuntu0.16.04.7
  • dnsmasq Ubuntu 18.04 LTS 2.79-1ubuntu0.2
  • dnsmasq Ubuntu 20.04 LTS 2.80-1.1ubuntu1.2

ubuntu advisories UBUNTU-CVE-2020-25682

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dnsmasq RHEL 8 2.79-13.el8_3.1
  • dnsmasq-utils RHEL 8 2.79-13.el8_3.1
  • dnsmasq RHEL 8.1 EUS 2.79-6.el8_1.1
  • dnsmasq-utils RHEL 8.1 EUS 2.79-6.el8_1.1
  • dnsmasq RHEL 8.2 EUS 2.79-11.el8_2.2
  • dnsmasq-utils RHEL 8.2 EUS 2.79-11.el8_2.2

red hat advisories RHSA-2021:0150RHSA-2021:0152RHSA-2021:0151

  • dnsmasq SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +14 more 2.78-18.15.1
  • dnsmasq SLE Point of Sale 11 SP3 2.78-0.16.14.1
  • dnsmasq SLE Module for Basesystem 15 SP2, SLE Module for Basesystem 15 SP1 2.78-7.6.1
  • dnsmasq SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2.78-3.11.1
  • dnsmasq SLES 11 SP4-LTSS 2.78-0.17.15.1

suse advisories SUSE-SU-2021:0166-1SUSE-SU-2021:14604-1SUSE-SU-2021:14603-1SUSE-SU-2021:0163-1SUSE-SU-2021:0162-1

  • dnsmasq openSUSE Leap 15.1 2.78-lp151.5.6.1
  • dnsmasq openSUSE Leap 15.2 2.78-lp152.7.3.1

opensuse advisories openSUSE-SU-2021:0129-1openSUSE-SU-2021:0124-1

  • dnsmasq Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 2.83-r0

alpine advisories ALPINE-CVE-2020-25682

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dnsmasq Arch Linux 2.83-1

arch linux advisories AVG-1470

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-25682 updated cvss 8.1

dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled

  • Red Hat Enterprise Linux AppStream (v. 8) dnsmasq 2.79-13.el8_3.1, dnsmasq-utils 2.79-13.el8_3.1
    fixed: vendor fix “The only known way to mitigate this flaw is to disable DNSSEC altogether, by removing the `--dnssec` command line option or the `dnssec` option from dnsmasq configuration file.” RHSA-2021:0150
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) dnsmasq 2.79-6.el8_1.1, dnsmasq-utils 2.79-6.el8_1.1
    fixed: vendor fix “The only known way to mitigate this flaw is to disable DNSSEC altogether, by removing the `--dnssec` command line option or the `dnssec` option from dnsmasq configuration file.” RHSA-2021:0152
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) dnsmasq 2.79-11.el8_2.2, dnsmasq-utils 2.79-11.el8_2.2
    fixed: vendor fix “The only known way to mitigate this flaw is to disable DNSSEC altogether, by removing the `--dnssec` command line option or the `dnssec` option from dnsmasq configuration file.” RHSA-2021:0151
  • Red Hat Enterprise Linux 5 dnsmasq Red Hat Enterprise Linux 6 dnsmasq, dnsmasq-utils Red Hat Enterprise Linux 7 dnsmasq, dnsmasq-utils Red Hat Enterprise Linux 9 dnsmasq, dnsmasq-utils Red Hat OpenStack Platform 10 (Newton) dnsmasq-utils Red Hat OpenStack Platform 13 (Queens) dnsmasq-utils
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

75.07% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.3 AV:N/AC:M/Au:N/C:P/I:P/A:C

Affected products

  • n/a dnsmasq

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.