Critical Cache Poisoning Vulnerability in Dnsmasq

[Toinks]

Posting it here as I would like to understand if and how ASUS routers are affected, and if affected is there mitigation.
Please move post as applicable.

from https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2025q3/018288.html

The issue allows attackers to inject arbitrary malicious DNS resource records and poison domain names without requiring advanced techniques, only by leveraging a single special character.

Report Summary
Vulnerability Type: Logic flaw in cache poisoning defense
Affected Software: Dnsmasq (all versions)
Severity: Critical
Exploitability: Off-path attackers can brute-force TxID and source port within an extended attack window
Attack Name:SHAR Attack (Single-character Hijack via ASCII Resolver-silence)
Success Rate: 20/20 successful attack attempts
Average Execution Time: ~9,469 seconds

Key Findings
Dnsmasq forwards queries with special characters (e.g., ~, !, *, _) to upstream recursive resolvers.
Some upstream recursive resolvers silently discard such malformed queries (no NXDomain/ServFail response).
Dnsmasq does not validate or detect this situation, and waits silently, creating a large attack window.
During this window, attackers can brute-force TxID (16-bit) and source port (16-bit) with a high probability of success (birthday paradox effect).

Security Impact
Attackers can poison any cached domain name in Dnsmasq.
Attack is feasible off-path without IP fragmentation or side-channels.
This vulnerability also amplifies known cache poisoning attacks such as SADDNS and Tudoor.
Undermines DNS security assumptions that resolver silence is benign.

Proof of Concept
We tested against a real domain (viticm.com) and demonstrated that queries containing certain crafted characters lead to upstream silence. This allowed us to reliably poison Dnsmasq caches in all trials.

Suggested Mitigation
We recommend adding:
Detection mechanisms when upstream resolvers remain silent.
Rate limiting and spoof-detection techniques, similar to those in PowerDNS.

 

[Tech9]

and if affected is there mitigation

Just continue reading the same thread.

[Dnsmasq-discuss] [Security Report] Critical Cache Poisoning Vulnerability in Dnsmasq