Dnsmasq DNS Remote Heap Buffer Overflow (CVE-2026-2291)

src/binary-exploitation/libc-heap/heap-overflow.md

@@ -146,6 +146,21 @@ The implementation also performed `destination = stored_pointer - packet_length`
 > [!NOTE]
 > If the corrupted process cannot safely continue, execute persistence or cleanup logic **before** the inevitable fault. In the NetScaler chain, shellcode replaced fatal-signal handlers with `SIG_IGN` via FreeBSD `sigaction`, preventing the handlers from asking the supervisor to reboot the appliance. The supervisor then respawned only the packet engine, preserving files written before the crash. This behavior is supervisor-specific and should be verified by tracing the process-to-watchdog notification path.<sup>[[10]](#references)</sup>
 
+### Length-expanding decoders and application free-list poisoning
+
+Size buffers for the **largest internal representation**, not only for the wire input. Dnsmasq's DNS-name decoder escapes `0x00`, `0x2e`, and `0x01`, so a wire byte can require two bytes in the internal C string. The cache selected a 1,025-byte `bigname` allocation when the decoded name exceeded the 49-byte small-name limit, but it did not check the escaped length before `strcpy()`. The upstream fix changed this storage to `(2 * MAXDNAME) + 1`, allowing for worst-case expansion and the terminator.<sup>[[15]](#references)[[16]](#references)</sup>
+
+A protocol parser can therefore enforce its wire-length limit while a later decoding step still creates an oversized object. Validate the length after each representation change and compare that value with the destination capacity.<sup>[[15]](#references)[[16]](#references)</sup>
+
+#### Turning an application free list into an arbitrary write
+
+The Dnsmasq example poisons an **application-managed** singly linked free list rather than glibc metadata. The affected objects remain in the `big_free` pool instead of being passed to `free()`, so libc integrity checks and safe-linking protections described for [tcache poisoning](tcache-bin-attack.md) do not inspect the corrupted link. The demonstrated remote path requires a resolver configured with an attacker-controlled upstream DNS server.<sup>[[16]](#references)</sup>
+
+1. A long CNAME chain consumes large-name objects. A response that is not retained in the cache returns those objects to `big_free`; the published example used the `CD` bit to obtain this layout.
+2. An expanded name reuses an adjacent object and overflows into the next free object's link. On the demonstrated 32-bit target, this overwrites the first four bytes with the intended write address.
+3. The next allocation removes that entry and promotes its forged link to the free-list head. A second allocation then treats the chosen address as a large-name buffer, and the normal `strcpy()` becomes a constrained write-what-where operation. The terminating NUL and decoder escaping constrain the bytes that can be written.
+4. The published x86/musl example targeted the `VDSO_CGT32_SYM` function pointer in `ld.so`. Triggering the later indirect call gave instruction-pointer control, but reliable code execution still required an information leak or another ASLR bypass.<sup>[[16]](#references)</sup>
+
 ### Real-World Example: CVE-2025-40597 – Misusing `__sprintf_chk`
 
 In SonicWall SMA100 firmware 10.2.1.15 the reverse-proxy module `mod_httprp.so` allocates an **0x80-byte** heap chunk and then concatenates several strings into it with `__sprintf_chk`:<sup>[[1]](#references)</sup>
@@ -195,5 +210,7 @@ Practical exploitation would require **heap grooming** to place a controllable o
 - [12] [FreeRDP Advisory GHSA-2vf2-grvj-6g8x — Routing token heap overflow](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x)
 - [13] [FreeRDP Advisory GHSA-hw7p-5h2r-83gq — USB redirection heap disclosure](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq)
 - [14] [Quarkslab — From AI Agents to RCE: Building a Vulnerability Research Workflow](https://blog.quarkslab.com/from-ai-agents-to-rce-building-a-vulnerability-research-workflow.html)
+- [15] [Dnsmasq upstream patch for CVE-2026-2291](https://thekelleys.org.uk/dnsmasq/CVE/CVE-2026-2291.diff)
+- [16] [Exodus Intelligence – Dnsmasq DNS Remote Heap Buffer Overflow](https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/)
 
 {{#include ../../banners/hacktricks-training.md}}