CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
376 points
• 6 days ago
• Article
Link
2026 年 5 月 11 日，Simon Kelley 宣布 CERT 正在披露 dnsmasq 中的六个严重安全漏洞。这些漏洞长期存在，影响几乎所有现代版本的软件。厂商已被提前通知，预计很快会有相应的 dnsmasq 软件包补丁发布。详细信息和补丁可在 dnsmasq 官网找到，修复版本 2.92rel2 已可下载。
这些修复也已提交到开发分支。部分是向后移植的补丁，另一些则是更全面的重写，旨在从根本上解决问题。 Simon 指出，基于 AI 的安全研究大幅增加，导致漏洞报告激增。他花了大量时间来管理这些报告、过滤重复项，并判断哪些问题需要向供应商预先通报、哪些需要立即修复。他认为，鉴于"好人"和"坏人"都可能发现这些漏洞，长期保密期变得越来越不现实，协调保密和回溯修补的工作也非常繁重。
Simon 强调必须在今后的版本中修复这些漏洞，力求让新版本尽可能无漏洞。他提到，在此次公告发布前的几周里，已有多项安全修复提交到 git 仓库。他计划尽快发布 dnsmasq-2.93rc1，目标是尽快推出稳定的 2.93 版本，并鼓励社区测试该发布候选版本，以帮助尽早推出稳定版本。
展望未来，Simon 承认 AI 生成的漏洞报告潮流不太可能停止，因此漏洞管理和修复的工作很可能会持续。他计划优先保证 2.93 按时发布，即便这意味着一些正在进行的修复将在发布后再处理。总体目标仍是不断提高 dnsmasq 的安全性和稳定性。
On May 11, 2026, Simon Kelley announced that six serious security vulnerabilities in dnsmasq are being disclosed by CERT. These are long-standing bugs affecting nearly all modern versions of the software. The vulnerabilities have already been pre-disclosed to vendors, so patched versions of their dnsmasq packages are expected to be released soon. Details and patches are available on the official dnsmasq website, and a fixed release, version 2.92rel2, has been made available for download.
The fixes for these bugs have also been committed to the development tree. While some fixes are backported patches, others are more comprehensive rewrites aimed at addressing root causes. Simon notes that there has been a significant increase in AI-based security research, leading to a flood of bug reports. He has spent considerable time managing these reports, filtering duplicates, and deciding which issues require vendor pre-disclosure and which should be fixed immediately. He believes that long embargoes are becoming less practical, given that both "good guys" and "bad guys" are likely finding these bugs, and the effort to coordinate embargoes and backports is substantial.
Simon emphasizes the importance of fixing bugs in future releases and making new versions as bug-free as possible. He mentions that many security-fix commits have already been made to the git repository in the weeks leading up to this announcement. He plans to release dnsmasq-2.93rc1 soon, with the goal of a stable 2.93 release as quickly as possible. He encourages community testing of the release candidate to help ensure a timely and stable release.
Looking ahead, Simon acknowledges that the influx of AI-generated bug reports is unlikely to stop, so this process of managing and fixing vulnerabilities will likely continue. He plans to prioritize the timely release of version 2.93, even if it means some ongoing fixes will be addressed after the release. The focus remains on improving the security and stability of dnsmasq moving forward.
243 comments • Comments Link
MaraDNS 已接受了广泛的安全审计（包括 AI 辅助审计），自 2023 年以来未发现严重漏洞。唯一发现的问题都是一些次要的边缘情况，例如在异常条件下资源释放较慢，或仅在极长的 $HOME 路径下才会触发的弃用工具中的缓冲区溢出。
尽管 MaraDNS 捆绑了 Lua 5.1（即 Lunacy），开发者已主动修补了已知漏洞（如 CVE-2014-5461）并采取了额外的安全加固措施。选择 Lua 5.1 的原因是它被广泛采用并被大量 fork，应用于 Adobe Illustrator 、 Roblox（通过 Luau）和 LuaJIT 等系统。
Lua 脚本组件（Lunacy）仅用于 coLunacyDNS —— 这是一个沙箱服务器，脚本只能在本地运行，无法进行远程执行。这显著限制了攻击面，即便理论上存在 Lua 漏洞。
批评者指出，捆绑 Lua 会让维护者对所有 Lua CVE 负责，无论漏洞代码路径是否可达。但语境很重要：许多 Lua 的 CVE 需要精心构造的输入或特定条件，而这些条件在具体部署中往往并不成立。
Debian 的 stable 发布模型依赖于向后移植安全修复，而不是升级到新版本，这一做法被辩护为保障生产稳定性的关键。它能让组织在避免意外行为变化的同时，仍接收关键的安全补丁。
反对者认为，Debian 的方法会导致软件陈旧、维护滞后以及容易出错的手工向后移植。他们主张采用自动化测试和内存安全语言（例如 Rust）等现代实践，从长远来看会更有效。
讨论凸显了稳定性与安全之间的紧张关系：Debian stable 更注重可预测的行为，而另一派则主张更频繁地更新或迁移到更安全的语言以降低漏洞风险。
AI 辅助审计是一把双刃剑——它能更快地发现漏洞，但也提高了对所有软件的审查强度，尤其是流行项目。不过，像 MaraDNS 这样虽不那么流行但审计充分的项目，实际上可能比那些被广泛使用却有更多未被发现缺陷的替代方案更安全。
dnsmasq 虽然在路由器和嵌入式系统中很受欢迎，但最近遭遇了多个严重 CVE，包括堆越界写入和由畸形数据包引起的无限循环。它在很少更新的设备中的广泛部署使这些漏洞尤为令人担忧。
一些用户更偏好模块化工具，而不是像 dnsmasq 这样的全能解决方案，这也符合 Unix 哲学中单一用途工具的理念。像 MaraDNS 这样的替代方案提供了专注且具有良好安全记录的功能，尽管其采用度不及 dnsmasq 。
总体来看，讨论反映出两种截然不同的观点：一方重视软件稳定性，另一方则优先通过现代语言和频繁更新来主动提升安全性。 AI 审计提高了漏洞检测的标准，但也暴露出维护遗留 C 代码库的局限性。受欢迎程度未必等于安全性，像 MaraDNS 这样的维护良好的小型项目展示了较强的韧性。关于 Debian 版本模型的争论则强调了生产可靠性与及时安全改进之间的权衡，目前尚无一致的最佳方案。 • MaraDNS has undergone extensive security audits, including AI-assisted ones, with no serious security bugs found since 2023. The only issues discovered are minor edge cases, such as slow resource release under unusual conditions or a buffer overflow in a deprecated utility triggered only by unusually long $HOME paths.
• While MaraDNS bundles Lua 5.1 (as Lunacy), the developer has proactively patched known vulnerabilities like CVE-2014-5461 and applied additional security hardening. Lua 5.1 was chosen because it's the most widely adopted and forked version, used in systems like Adobe Illustrator, Roblox (via Luau), and LuaJIT.
• The Lua scripting component (Lunacy) is only used in coLunacyDNS, a sandboxed server where scripts can only be controlled locally—remote execution is impossible. This limits the attack surface significantly, even if theoretical Lua vulnerabilities exist.
• Critics argue that vendoring Lua makes the maintainer responsible for all Lua CVEs, regardless of whether the vulnerable code paths are reachable. However, context matters: many Lua CVEs require crafted input or specific conditions that may not apply in a given deployment.
• Debian's stable release model, which relies on backporting security fixes rather than upgrading to new versions, is defended as essential for production stability. It allows organizations to avoid unexpected behavior changes while still receiving critical security patches.
• Critics counter that Debian's approach leads to outdated software, deferred maintenance, and error-prone manual backporting. They argue that modern practices like automated testing and memory-safe languages (e.g., Rust) would be more effective long-term.
• The discussion highlights a tension between stability and security: Debian stable prioritizes predictable behavior, while others advocate for more frequent updates or migration to safer languages to reduce vulnerability risk.
• AI-assisted auditing is becoming a double-edged sword—while it helps find bugs faster, it also increases scrutiny on all software, especially popular projects. However, less popular but well-audited software like MaraDNS may actually be more secure than widely used alternatives with more undiscovered flaws.
• dnsmasq, despite its popularity in routers and embedded systems, has recently faced multiple serious CVEs, including heap out-of-bounds writes and infinite loops from malformed packets. Its widespread use in rarely updated devices makes these vulnerabilities particularly concerning.
• Some users prefer modular tools over all-in-one solutions like dnsmasq, aligning with the Unix philosophy of single-purpose utilities. Alternatives like MaraDNS offer focused functionality with strong security track records, though they lack the broad adoption of dnsmasq.
The discussion reveals a deep divide between those who value software stability and those who prioritize proactive security through modern languages and frequent updates. While AI auditing is raising the bar for vulnerability detection, it also exposes the limitations of maintaining legacy C codebases. Popularity does not necessarily correlate with security, as smaller, well-maintained projects like MaraDNS demonstrate strong resilience despite less visibility. Meanwhile, the debate over Debian's release model underscores the trade-offs between production reliability and timely security improvements, with no clear consensus on the optimal approach.