Memory Leak Vulnerability in dnsmasq: Denial of Service Risk
Summary
ALPINE-CVE-2017-14495: Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creat... Affects dnsmasq versions < 2.78-r0. Fixed in 2.78-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dnsmasq is a lightweight DNS forwarder and DHCP server widely used in small networks and embedded systems. It provides essential network services such as DNS caching and DHCP address assignment, making it a critical component for network management. However, certain configurations can expose dnsmasq to vulnerabilities, including memory leaks that can lead to service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2017-14495 is a memory leak in dnsmasq versions prior to 2.78. This issue arises when the --add-mac, --add-cpe-id, or --add-subnet options are specified, allowing remote attackers to exploit the vulnerability. The result is a denial of service (DoS) due to excessive memory consumption, which can lead to system instability or crashes. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.78-r0
This is the first release that contains the fix.
sudo apk add --upgrade dnsmasqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the use of the --add-mac, --add-cpe-id, or --add-subnet options in your dnsmasq configuration to mitigate the risk of exploitation until you can apply the patch.
Conclusion
The memory leak vulnerability in dnsmasq (CVE-2017-14495) poses a significant risk of denial of service due to excessive memory consumption. It is crucial to update to the patched version 2.78-r0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for dnsmasq →
FAQ
dnsmasq is a DNS forwarder and DHCP server that provides essential network services, particularly in small networks and embedded systems.
CVE-2017-14495 refers to a memory leak vulnerability in dnsmasq that can lead to denial of service due to excessive memory consumption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failing to fix this vulnerability can lead to service disruptions, system instability, and potential crashes due to memory exhaustion.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for dnsmasq.
