CVE-2020-25685: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2020-25685) was discovered in dnsmasq versions before 2.83. When processing a reply from a forwarded query, dnsmasq's reply_query() function only uses a weak hash of the query name to match the reply with the forwarded query. The weak hash implementation (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) allows an off-path attacker to find different domains with matching hashes, significantly reducing the number of attempts needed to forge an accepted reply (NVD, Red Hat).

The vulnerability exists in the forward.c:reply_query() function where dnsmasq only uses a weak hash to match DNS query replies. The implementation uses CRC32 for non-DNSSEC builds and SHA-1 for DNSSEC-enabled builds. This weak verification contrasts with RFC5452, which requires using the full query name as one of the attributes for matching replies. The vulnerability has a CVSS v3.1 Base Score of 3.7 (Low) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD, Red Hat).

The primary impact of this vulnerability is to data integrity. An attacker can exploit this flaw to perform DNS Cache Poisoning attacks, which would affect all clients using dnsmasq as their DNS server. When chained with CVE-2020-25684, the attack complexity is reduced, making it more feasible to execute successful attacks (NVD, Red Hat).

The vulnerability requires an off-path attacker who can find multiple domains with matching hashes. The attacker must also have some control over a dnsmasq client or other means to trigger DNS queries to dnsmasq for an attacker-controlled domain. The attack can be performed in as little as a few minutes when chained with other related vulnerabilities (Red Hat).

The primary mitigation is to upgrade to dnsmasq version 2.83 or later. For systems that cannot be immediately upgraded, the impact can be reduced by disabling the dnsmasq cache by adding --cache-size=0 to the dnsmasq command line or adding cache-size=0 to the dnsmasq configuration file. However, disabling the cache may result in performance degradation as all DNS queries will be forwarded to upstream servers (Red Hat, Arista).

The vulnerability was part of a larger set of vulnerabilities dubbed "DNSpooq" discovered by Moshe Kol and Shlomi Oberman from JSOF. Multiple vendors including Red Hat, Debian, Fedora, and Arista Networks released security advisories and patches to address the vulnerability (Debian, Gentoo, Arista).