Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

imp/dnsmasq

              master @ cf08eee
            

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Denial of Service: 38 prior fixes. Scrutinize any change in this area.

src/dnssec.c: most-fixed (20 issues). Treat as high-risk during review.

39 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes show DNSSEC validation can be bypassed via incorrect handling of DNAME, wildcards, NSEC/NSEC3 proofs, ANY queries, and mixed validated/unvalidated RRsets, allowing forged records to be accepted.

Buffer Overflow: Critical heap and stack overflows in DNS name and record parsing (CVE-2017-14491, off-by-one) allow remote code execution via crafted packets; bounds checks were missing before writes.

Denial of Service: CPU-exhaustion via cryptographic validation loops and sub-queries (CVE-2023-50387, CVE-2023-50868) and infinite loops from dependency cycles can hang the daemon; resource limits were added.