Kevin Hamacher

**Name of the Vulnerable Software and Affected Versions** Linux (affected versions not specified) **Description** The issue is caused by improper handling of VM IO|VM PFNMAP vmas in KVM, which can bypass RO checks and lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory, resulting in local privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to a memory leak that can be triggered when specific options such as `--add-mac`, `--add-cpe-id`, or `--add-subnet` are used. This allows remote attackers to cause a denial of service by consuming memory through vectors involving DNS response creation. **Recommendations** For dnsmasq versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the `--add-mac`, `--add-cpe-id`, and `--add-subnet` options until the update is applied.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is a heap-based buffer overflow that can be triggered by a crafted DNS response, allowing remote attackers to cause a denial of service or execute arbitrary code. This can occur due to a missing bounds check in the `do rfc1035 name` function of `util.c`, potentially leading to an out of bounds write. The exploitation of this issue does not require user interaction and can result in remote code execution, denial of service, or an out of memory situation. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting DNS response processing to minimize the risk of exploitation. Avoid using the `do rfc1035 name` function in `util.c` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dnsmasq versions prior to 2.78 **Description** The issue is caused by a heap-based buffer overflow in the dynamic memory of the DNS server. This can be exploited by a remote attacker using a specially crafted IPv6 request, potentially allowing them to cause a denial of service or execute arbitrary code. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is related to deficiencies in handling forwarded DHCPv6 requests, which can be exploited by a remote attacker to disclose sensitive information by injecting special elements into a command. This can allow remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 relay functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is caused by a stack-based buffer overflow in the DNS server. It can be exploited by a remote attacker using a specially crafted DHCPv6 request, potentially leading to a denial of service or the execution of arbitrary code. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 service to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions prior to 2.78 **Description** The issue is caused by an integer underflow in the `add pseudoheader` function of the Dnsmasq DNS server when the `--add-mac`, `--add-cpe-id`, or `--add-subnet` option is specified. This allows a remote attacker to cause a denial of service via a specially crafted DNS request. **Recommendations** For versions prior to 2.78, update to version 2.78 or later to resolve the issue. As a temporary workaround, consider disabling the `add pseudoheader` function or avoiding the use of the `--add-mac`, `--add-cpe-id`, or `--add-subnet` options until a patch is available.