CVE-2020-25684: loose address/port check in reply_query() makes forging replies easier for an off-path attacker

Description Riccardo Schirone 2020-10-20 11:21:29 UTC

When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query() if the reply destination address/port is one of those used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies the attributes of a query that all must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack.

Comment 14 lnacshon 2020-12-07 11:18:48 UTC

OSD3 are using dnsmasq which is shipped with rhel-7, no any security wrapping on dnsmasq which may prevent the attack

Comment 19 Riccardo Schirone 2021-01-14 11:27:34 UTC

Red Hat Enterprise Linux 5, 6, 7, and 8 are all affected in the same way and the same mitigations apply.

Comment 21 Eric Christensen 2021-01-14 19:52:13 UTC

Mitigation:

The impact of this flaw can be reduced by disabling the dnsmasq cache by adding `–cache-size=0` when calling dnsmasq or by adding a line with `cache-size=0` to the dnsmasq configuration file (/etc/dnsmasq.conf by default).

When using Red Hat Enterprise Linux 8.3 with libvirt through a virt:rhel module, use `virsh net-edit <network-name>` and reference https://libvirt.org/formatnetwork.html#elementsNamespaces to add the suggested option `cache-size=0`.

There is no way to customize the dnsmasq configuration generated by libvirt, when using versions of Red Hat Enterprise Linux prior to version 8.3. If dnsmasq is being run through NetworkManager, create a new file in /etc/NetworkManager/dnsmasq.d/ and add `cache-size=0` to it.

In all cases, by disabling the cache, you may experience a performance loss in your environment due to all DNS queries being forwarded to the upstream servers. Please evaluate if the mitigation is appropriate for the system’s environment before applying.

Comment 23 Riccardo Schirone 2021-01-15 14:43:33 UTC

Statement:

Dnsmasq may be run by libvirt and/or NetworkManager. libvirt uses dnsmasq by default to provide DNS service to its guests. NetworkManager may be configured to use dnsmasq to provide DNS service to the system, if a line `dns=dnsmasq` is present in the `[main]` section of the configuration file /etc/NetworkManager/NetworkManager.conf.

In Red Hat OpenStack Platform (RHOSP) and Red Hat Virtualization (RHV), the dnsmasq package is provided by the underlying Red Hat Enterprise Linux (RHEL) product. RHOSP and RHV are therefore indirectly affected, so please ensure that the underlying RHEL dnsmasq package is updated.

Comment 24 Riccardo Schirone 2021-01-15 17:16:11 UTC

Acknowledgments:

Name: Moshe Kol (JSOF), Shlomi Oberman (JSOF)

Comment 27 Riccardo Schirone 2021-01-19 11:56:29 UTC

Created dnsmasq tracking bugs for this issue:

Affects: fedora-all [bug 1917784]

Comment 33 errata-xmlrpc 2021-01-19 13:36:01 UTC

This issue has been addressed in the following products:

Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:0156 https://access.redhat.com/errata/RHSA-2021:0156