Google Online Security Blog: Behind the Masq: Yet more DNS, and DHCP, vulnerabilities

Security Blog

The latest news and insights from Google on security and safety on the Internet

Behind the Masq: Yet more DNS, and DHCP, vulnerabilities

2 October 2017

Posted by Fermin J. Serna, Staff Software Engineer, Matt Linton, Senior Security Engineer and Kevin Stadmeyer, Technical Program ManagerDNS vulnerabilities and exploitsDnsmasqinternetproject’s git repositoryseccomp-bpfherelatest version

CVE

Impact

Vector

Notes

PoC

CVE-2017-14491

RCE

DNS

Heap based overflow (2 bytes). Before 2.76 and this commit overflow was unrestricted.

PoC, instructions and ASAN report

CVE-2017-14492

RCE

DHCP

Heap based overflow.

PoC, instructions and ASAN report

CVE-2017-14493

RCE

DHCP

Stack Based overflow.

PoC, instructions and ASAN report

CVE-2017-14494

Information Leak

DHCP

Can help bypass ASLR.

PoC and Instructions

CVE-2017-14495

OOM/DoS

DNS

Lack of free() here.

PoC and instructions

CVE-2017-14496

DoS

DNS

Invalid boundary checks here. Integer underflow leading to a huge memcpy.

PoC, instructions and ASAN report

CVE-2017-13704

DoS

DNS

Bug collision with CVE-2017-13704

CVE-2017-14491 is a DNS-based vulnerability that affects both directly exposed and internal network setups. Although the latest git version only allows a 2-byte overflow, this could be exploited based on previous research. Before version 2.76 and this commit the overflow is unrestricted.

WRITE of size 1 at 0x62200001dd0b thread T0 #0 0x5105e6 in add_resource_record /test/dnsmasq/src/rfc1035.c:1141:7 #1 0x5127c8 in answer_request /test/dnsmasq/src/rfc1035.c:1428:11 #2 0x534578 in receive_query /test/dnsmasq/src/forward.c:1439:11 #3 0x548486 in check_dns_listeners /test/dnsmasq/src/dnsmasq.c:1565:2 #4 0x5448b6 in main /test/dnsmasq/src/dnsmasq.c:1044:7 #5 0x7fdf4b3972b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) #6 0x41cbe9 in _start (/test/dnsmasq/src/dnsmasq+0x41cbe9)

CVE-2017-14493 is a trivial-to-exploit DHCP-based, stack-based buffer overflow vulnerability. In combination with CVE-2017-14494 acting as an info leak, an attacker could bypass ASLR and gain remote code execution.

dnsmasq[15714]: segfault at 1337deadbeef ip 00001337deadbeef sp 00007fff1b66fd10 error 14 in libnss_files-2.24.so[7f7cfbacb000+a000]

Android is affected by CVE-2017-14496 when the attacker is local or tethered directly to the device—the service itself is sandboxed so the risk is reduced. Android partners received patches on 5 September 2017 and devices with a 2017-10-01 security patch level or later address this issue.

Proofs of concept are provided so you can check if you are affected by these issues, and verify any mitigations you may deploy.

We would like to thank the following people for discovering, investigating impact/exploitability and developing PoCs: Felix Wilhelm, Fermin J. Serna, Gabriel Campana, Kevin Hamacher, Ron Bowes and Gynvael Coldwind of the Google Security Team.