CVE-2020-25683: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2020-25683) was discovered in dnsmasq when DNSSEC is enabled and before it validates received DNS entries. The vulnerability affects dnsmasq versions before 2.83 and was disclosed in January 2021. This vulnerability specifically impacts systems where dnsmasq is compiled with DNSSEC support and has DNSSEC enabled in its configuration (NVD, Red Hat).

The vulnerability is caused by the lack of length checks in rfc1035.c:extract_name() function, which could be abused to make the code execute memcpy() with a negative size in get_rdata(). The flaw requires DNSSEC to be compiled and enabled (e.g., with --dnssec option). The vulnerability has a CVSS v3.1 Base Score of 5.9 (MEDIUM) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, Red Hat).

The vulnerability can result in a crash of the dnsmasq service, leading to a denial of service condition. The highest threat from this vulnerability is to system availability. The impact is particularly significant when dnsmasq is used as an Open Resolver or when the attacker is on the internal network covered by dnsmasq (Red Hat).

To exploit this vulnerability, an attacker must either control a DNS server used in the domain name resolution process or be able to inject packets on the network to trick dnsmasq into accepting them. The attacker needs to be able to create valid DNS replies and either have control over a dnsmasq client system or be able to trick a victim into performing multiple DNS queries to an attacker-controlled domain (Red Hat).

The only known way to mitigate this vulnerability is to disable DNSSEC altogether by removing the --dnssec command line option or the dnssec option from the dnsmasq configuration file. The permanent fix is to upgrade to dnsmasq version 2.83 or later, which contains the security patch (Red Hat, Gentoo).