Dnsmasq DHCPv6 Client Hostname Parser Buffer Overflow

Executive Summary

This vulnerability is in dnsmasq's DHCPv6 client hostname parser. It reads one byte past the end of a crafted Fully Qualified Domain Name (FQDN) option due to checking the next label length before confirming the pointer is still inside the option. An attacker on the local network can exploit this with a single DHCPv6 packet.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a DHCPv6 client hostname parser flaw in dnsmasq. Detection requires checking if dnsmasq is running and inspecting DHCPv6 traffic for malformed FQDN options. Use packet capture tools like tcpdump or Wireshark to monitor DHCPv6 packets for unusual label lengths or pointers. Example command: tcpdump -i any -n port 547 or port 546. Ensure dnsmasq logs are enabled for anomalies.

Useful 0 Not Useful 0

Impact Analysis

An attacker on the local network could potentially exploit this to read memory outside the intended buffer. However, the extra byte is not returned to the client or logged, and no crash has been demonstrated, limiting the practical impact.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update dnsmasq to the latest patched version. If an update is unavailable, disable DHCPv6 functionality in dnsmasq by removing or commenting out the dhcp-range6 directive in the configuration file. Restart the service after changes. Monitor network traffic for suspicious DHCPv6 activity during this period.

Useful 0 Not Useful 0