Re: Questionable CVE's reported against dnsmasq

[Art Manion <zmanion () protonmail com>]

On 2025-10-27 18:49, Solar Designer wrote:

> What's common about the CVEs mentioned in this thread, including those
> against GNU Bison (so not config file parsing, but just bogus CVEs), is
> that all of them were assigned by VulDB as the CNA.  VulDB even went to
> the effort (or automation?) to generate CVSS 2.0, 3.0, 3.1, and 4.0
> vectors for all of these.  It's pretty ridiculous for a CNA not only to
> assign bogus CVEs, but also have CVSS vectors and scores for them
> without realizing the error.  This suggests a lack of proper process
> and/or expertise.
>
> At this point, I think we want to hear from VulDB on this, and from
> MITRE on their requirements for CNAs in general and VulDB in particular
> to review CVE requests before assignment.  Maybe VulDB is in violation.

Speaking as a CVE Board member, but not for MITRE, I suggest that somebody dispute the dnsmasq (and Bison) CVE IDs.  
I'll do this unless somebody else wants to.  There is room for improvements to CVE assignment, but the current path is 
to file disputes.  Perhaps CNAs with "high" dispute counts or ratios warrant some sort of action.

Considering the CVE vulnerability determination rules, if there is no net security impact or gain to the attacker, then:

"4.1.2 Conditions or behaviors that do not lead to a security impact SHOULD NOT be determined to be Vulnerabilities. 
Examples of security impacts include an increase in access for an attacker, a decrease in availability of a target, or 
another violation of security policy."

https://www.cve.org/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination

Does dnsmasq read the config file before dropping privileges?  I think so, since dnsmasq needs to know what interfaces 
and ports to bind to?

Does dnsmasq check that the config file is root-owned and not user-writable?  In my brief testing, no.

Can a regular user call dnsmasq with '-C dnsmasq_malicious.conf' and achieve memory corruption under root privileges?  
Even if it's unlikely to result in code execution, that privilege escalation may qualify as a CVE-worthy vulnerability.

Regards,

 - Art