Inbal Schussheim

**Name of the Vulnerable Software and Affected Versions** NLnet Labs Unbound versions 1.4.22 through 1.25.1 **Description** An issue exists where the secrecy of the randomized UDP source port, used to increase entropy in DNS transactions, is undermined when resolver load balancing policies depend on the source port. This occurs when the `so-reuseport: yes` configuration option is enabled, which is the default setting. Unbound partitions the UDP source port space into disjoint subsets assigned to specific worker threads. Because the kernel's SO REUSEPORT mechanism deterministically assigns queries to threads, the source port of an outgoing query to an authoritative name server reveals which worker thread processed the original client query. A malicious actor can map incoming UDP source ports to specific worker threads to facilitate DNS cache poisoning attacks by reducing the effective random port population per thread. **Recommendations** For versions 1.4.22 through 1.25.1, disable the `so-reuseport` option by setting it to `no` in the configuration to mitigate the risk of DNS cache poisoning.