12178 2017-10-04 06:21:21 +0000 Dnsmasq: multiple CVEs in Widely Used Dnsmasq Network Software ** Severity urgent ** 2018-06-14 15:01:44 +0000 1 1 7 Build System, Metadata & Runtime Security - Recipe Upgrade security unspecified Other Multiple RESOLVED FIXED Medium critical 2.3.4 1 sona.sarmadi joe.slater akuster bluelightning randy.macleod stephano --- --- No (bug/feature does not impact docs) oldest_to_newest 77329 0 sona.sarmadi 2017-10-04 06:21:21 +0000 • CVE-2017-14491—A DNS-based remote code execution vulnerability in Dnsmasq versions before 2.76 is marked as the most severe that allows for unrestricted heap overflows, affecting both directly exposed and internal network setups. • CVE-2017-14492—Another remote code execution vulnerability due to a DHCP-based heap overflow issue. • CVE-2017-14493—Another noteworthy DHCP-based remote code execution bug caused by a stack buffer overflow. According to Google, this flaw is trivial to exploit if it's used in conjunction with the flaw (CVE-2017-14494) mentioned below. • CVE-2017-14494—An information leak in DHCP which can be combined with CVE-2017-14493 to allow attackers bypass ASLR security mechanism and execute arbitrary code on a target system. • CVE-2017-14495—A flaw in Dnsmasq which can be exploited to launch a denial of service (DoS) attack by exhausting memory via DNS. The flaw impacts dnsmasq only if one of these options is used: --add-mac, --add-cpe-id or --add-subnet. • CVE-2017-14496—Google's Android operating system is specifically affected by this DoS issue which can be exploited by a local hacker or one who is tethered directly to the device. However, Google pointed out the service itself is sandboxed, so the risk to Android users is reduced. • CVE-2017-14497—Another DoS issue wherein a large DNS query can crash the software. 77409 1 bluelightning 2017-10-06 03:12:19 +0000 FWIW I have sent an upgrade for meta-networking master to 2.78 (in master-next, not yet merged into master): https://patchwork.openembedded.org/patch/144640/ That version includes fixes for the following CVEs (from dnsmasq's own changelog): CVE-2017-13704 CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 Are you sure you have the CVE numbers correct? CVE-2017-14497 appears to be for the kernel and not dnsmasq. 78414 2 bluelightning 2017-11-29 22:13:13 +0000 To update the status - my patch was merged into master (and rocko when it branched), but we are still missing fixes for pyro and possibly morty / earlier. I am not currently working on those - is anyone else? 79416 3 akuster 2018-02-11 23:50:48 +0000 backport to pyro and morty stable/*. pending merge to real branch 79622 4 akuster 2018-02-28 04:55:23 +0000 need to build, test and merge to stable branches 80417 5 randy.macleod 2018-04-26 08:10:00 +0000 Joe, can you build, test and if all goes well, send backport patches for pyro and morty to help out Armin. 80487 6 joe.slater 2018-05-03 14:03:42 +0000 Looking into using 2.78 -> 2.76 backport. CVE-2017-13704 is not relevant to 2.76 and is fixed in 2.78. 80488 7 randy.macleod 2018-05-03 15:55:07 +0000 Add a comment to see if Joe gets an email. 80494 8 joe.slater 2018-05-04 15:22:53 +0000 Patch sent for meta-networking/morty. 80707 9 akuster 2018-06-04 15:45:19 +0000 patches submitted to maintainer for inclusion in stable branches. 80731 10 randy.macleod 2018-06-07 15:11:48 +0000 Still marked as new in patchworks: https://patchwork.openembedded.org/patch/150498/ 80790 11 akuster 2018-06-14 15:01:44 +0000 in morty proper. http://cgit.openembedded.org/meta-openembedded/commit/?h=morty&id=997caf9146cd3797cd054e2adebd1fbb4df91911