Kevin Hamacher

The issue is caused by improper handling of VM IO|VM PFNMAP vmas in KVM, which can bypass RO checks and lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory, resulting in local privilege escalation.

The issue is related to a memory leak that can be triggered when specific options such as `--add-mac`, `--add-cpe-id`, or `--add-subnet` are used. This allows remote attackers to cause a denial of service by consuming memory through vectors involving DNS response creation.

The issue is a heap-based buffer overflow that can be triggered by a crafted DNS response, allowing remote attackers to cause a denial of service or execute arbitrary code. This can occur due to a missing bounds check in the `do rfc1035 name` function of `util.c`, potentially leading to an out of bounds write. The exploitation of this issue does not require user interaction and can result in remote code execution, denial of service, or an out of memory situation.

The issue is caused by a heap-based buffer overflow in the dynamic memory of the DNS server. This can be exploited by a remote attacker using a specially crafted IPv6 request, potentially allowing them to cause a denial of service or execute arbitrary code.

The issue is related to deficiencies in handling forwarded DHCPv6 requests, which can be exploited by a remote attacker to disclose sensitive information by injecting special elements into a command. This can allow remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.

The issue is caused by a stack-based buffer overflow in the DNS server. It can be exploited by a remote attacker using a specially crafted DHCPv6 request, potentially leading to a denial of service or the execution of arbitrary code.

The issue is caused by an integer underflow in the `add pseudoheader` function of the Dnsmasq DNS server when the `--add-mac`, `--add-cpe-id`, or `--add-subnet` option is specified. This allows a remote attacker to cause a denial of service via a specially crafted DNS request.