Dnsmasq DNS Remote Heap Buffer Overflow

* The vulnerability was fixed in Dnsmasq versions 2.92rel2 and 2.93 on May 11, 2026, under CVE-2026-2291.
* The vulnerability was introduced in release 2.73.
* The change involved handling domain names with '.' or '/000' within labels in DNSSEC mode.
* Processing DNS replies converts domain names to C strings using modified formatting that included escape sequences, potentially doubling storage requirements.
* The caching system uses a 1,025-byte buffer named bigname for storing resource records.
* An unsafe strcpy() call in the reallyinsert function was the root cause of the heap overflow.
* This overflow occurs when escaped domain names exceed the size of the bigname buffer.
* Exploitation involved chaining DNS requests to manipulate buffers on the free list and overwriting a pointer in ld.so to gain EIP control.

The narrative highlights a critical failure at the intersection of protocol parsing, memory management, and system-level execution control within networking software. The transition from standard string handling to specialized escape sequences introduces subtle complexity that is not adequately guarded by existing memory safety checks. The reliance on an unsafe function like strcpy() operating on dynamically sized buffers (bigname) demonstrates a systemic gap in enforcing boundaries, even when specific structures are introduced for optimization, like the caching mechanism.
The exploitation path reveals a layered attack: first leveraging an information leak/write primitive to corrupt the heap metadata (the free list pointer), followed by controlling object allocation and subsequent copying to achieve arbitrary write primitives. This pattern suggests that low-level parsing logic, when interacting with memory allocators, becomes a high-value target for advanced exploitation. The finding underscores the necessity of rigorously auditing code paths where string length is manipulated before use, especially in systems that bridge external protocol data with internal memory structures.
What are the assumptions underlying the safety mechanisms in this specific context? If caching behavior necessitates variable-length storage augmentation (like bigname), why was the bounds checking bypassed across the entire operation? What does the presence of N-Day research focus on—the timely patching vs. the window of exposure?