FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

dnsmasq -- heap use-after-free in dhcp6_no_relay

Affected packages
dnsmasq < 2.86_4,1
dnsmasq-devel < 2.86_4,1


VuXML ID 3f321a5a-b33b-11ec-80c2-1bb2c6a00592
Discovery 2022-03-31
Entry 2022-04-03

Petr Menšík reports:

Possible vulnerability [...] found in latest dnsmasq. It [was] found with help of oss-fuzz Google project by me and short after that independently also by Richard Johnson of Trellix Threat Labs.

It is affected only by DHCPv6 requests, which could be crafted to modify already freed memory. [...] We think it might be triggered remotely, but we do not think it could be used to execute remote code.


CVE Name CVE-2022-0934