CVE-2020-25687: debian debian_linux Heap-based Buffer Overflow

Vulnerability summary

CVE-2020-25687 is a high (CVSS 7.1) Heap-based Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 86.69% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Timeline

1. 20-01-2021
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().