CVE-2021-3448: Medium severity thekelleys dnsmasq vulnerability
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.
Other sources
When configured with --server=<address>@<interface> or similar (e.g. through dbus), dnsmasq configures a fixed UDP port for all outgoing queries to the specified upstream DNS server. If an attacker is able to discover the opened port through other means (e.g. port scanning, guessing or sniffing), he would just have to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw could be abused to perform a DNS Cache Poisoning attack.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/dnsmasqto a version that resolves this vulnerability.Fixed in 2.85 - Upgrade
Upgrade
dnsmasqto a version that resolves this vulnerability.Fixed in 2.85 - Configuration
Avoid dnsmasq configurations that, when using --server=<address>@<interface> (or similar), cause dnsmasq to set a fixed UDP port for outgoing queries to the specified upstream DNS server; this reduces the chance that an attacker can infer the transmission ID to forge accepted DNS replies.
dnsmasq --server=<address>@<interface> (fixed UDP port behavior) = Do not configure with --server=<address>@<interface> (or similar) that causes a fixed UDP port for forwarding queries; use other upstream configuration so dnsmasq does not use a fixed port for that interface
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2021-3448.
What is the severity level of CVE-2021-3448?
CVE-2021-3448 has a severity level of medium.
Which software versions are affected by CVE-2021-3448?
Dnsmasq versions before 2.85, Redhat Enterprise Linux 8.0, Fedora 32, Fedora 33, Fedora 34, and Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.9.0 are affected by CVE-2021-3448.
What is the description of CVE-2021-3448?
CVE-2021-3448 is a flaw in dnsmasq that allows an attacker on the network to guess the random transmission ID by finding the outgoing port used by dnsmasq.
How can this vulnerability be fixed?
To fix CVE-2021-3448, users should update dnsmasq to version 2.85 or later.