Saint DNSpooq, Poisoner of Caches

Patron of home routers, gullible DNS caches, and dnsmasq, which is inside everything.

Life

On 19 January 2021 JSOF researchers revealed seven vulnerabilities in dnsmasq, the little DNS server hidden in millions of routers and devices. Some allowed poisoning the cache and sending users to fake sites, others corrupting memory. The name blends DNS and spook: a ghost whispering the wrong addresses.

Prayer

O Saint DNSpooq, who gives wrong directions in a confident voice, let our DNS answers be true and signed. Amen.

How to celebrate

Celebrated by updating dnsmasq and discovering, along the way, how many devices at home it was hiding in.

Ask the wrong DNS for directions and you'll always arrive somewhere else.

Technical record

Disclosed on: January 19 2021
CVE: CVE-2020-25686 CVE-2020-25684 CVE-2020-25685 CVE-2020-25687 CVE-2020-25683 CVE-2020-25682 CVE-2020-25681
Product: dnsmasq

A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

Sources: jsof-tech.com · web.archive.org

Canonized by Pope Log4Shell I

Saint DNSpooq, Poisoner of Caches

Life

Prayer

How to celebrate

Technical record

Related saints

Sharing the feast day

Same year: 2021