Qifan Zhang

When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.

When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.

Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once. This only affects users that make their HTTP or RTR server available to untrusted networks.

Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.

A flaw exists when the software is configured with both a root trust anchor and an additional `trust-anchor:` for an island-of-security zone whose parent is provably insecure under the root chain. A malicious actor can use a forged NSEC reply with the SOA bit cleared to trick the system into treating the configured trust island as insecure. This occurs because the DNSSEC validator accepts and caches the NSEC insecure response, bypassing the required RRSIG validation. This behavior stems from a previous fix regarding type DS and NSEC queries from clients when a trust anchor for that name existed.

An issue exists when the software is configured with both a root trust anchor and an additional `trust-anchor:` for an island-of-security zone whose parent is provably insecure under the root chain. A malicious actor can deliver a forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG `SignerName` set to the insecure parent. This tricks the validator into using the root trust anchor and subsequently the insecure parent, resulting in the record being treated as insecure and denying the existence of records within the trust island.

An issue exists where a SVCB or HTTPS Resource Record (RR) that fills the wire format RDATA to capacity can allow an ECH parameter to overwrite the stack. Once the limit is exceeded, the base64 decoder can write attacker-controlled data of unlimited size. This occurs when zone files are fed directly to NSD, such as those coming from an operator-controlled provisioning system, rather than files written by NSD itself.

An issue occurs when base64 data is split into pieces of 3 characters or less, causing tokens to be incorrectly calculated as 0 bytes. This allows an attacker to overwrite the stack with up to 64K of controlled data. This can happen when a zone file is fed directly to NSD, such as from an operator-controlled provisioning system. Approximately 116.3k instances are identified globally.

A HIP resource record that fills the RDATA near or at its limit and contains another dname RDATA field (a HIP Rendezvous server) can cause a stack overflow, allowing up to 191 bytes of attacker-controlled data to overwrite the stack. This occurs when a zone file is fed directly to NSD, such as through an operator-controlled provisioning system, rather than being written by NSD itself.

Algorithmic complexity attacks, researched as 'ReTrap', can lead to service degradation when malicious zones are used. These attacks include TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism is exploited via responses with numerous mismatched DNSKEY, RRSIG, and DS records; DelegationTrap, which causes computational overhead during the iterative validation of the chain-of-trust for deeply nested domains; NsecTrap, which forces the resolver to validate excessive invalid NSEC records; and AdditionalTrap, where the default DNSSEC validation of the ADDITIONAL section is used to waste resources.

A degradation of service issue exists in the TCP/DoT reading procedure due to the absence of a limit on consecutive reads. A malicious actor can monopolize a single worker's entire event loop by streaming and sustaining a rate of distinct uncached names over the TCP/DoT connection, provided their writes remain ahead of the drain.

Zones configured with `zonemd-check: yes` that are located below a trust anchor contain a flaw where tampered zone contents may be served or stored to disk before the ZONEMD integrity check is completed. This occurs due to the asynchronous resolution of DS/DNSKEY records required for the check. If the `zonefile:` option is used to write a zonefile to disk while the ZONEMD check fails, the tampered data is reloaded upon startup and remains available until the next verification concludes. Even if verification subsequently fails, the tampered data persists on disk for future reloads.

Access control list items configured as BLOCKED to deny access on the proxy protocol port can be bypassed. This occurs when a connection is established over TCP or TLS and the query is sent twice on a connection that remains open.

On little-endian systems, the software incorrectly compares IP addresses with access control ranges. This occurs because IPv4 addresses are compared as unsigned 32-bit numbers using the host's endianness, while the comparison values remain in network byte order (big-endian). For IPv6 addresses, the process involves four separate unsigned 32-bit number comparisons, also failing to account for the difference between host endianness and network byte order. Consequently, IP addresses intended to be allowed may be denied, and those intended to be denied may be granted access.

A remote client can cause a crash of the NSD serve child process in debugging or non-release build types. This occurs when the process receives a specially crafted message containing a specific number of DNS Cookie options, such as 17 options when the UDP payload size is 512. Repeatedly crashing these processes can severely degrade performance or lead to a complete denial of DNS service.

Resource Record Signatures (RRSIGs) containing an insufficient number of labels can allow the bypass of DNSSEC wildcard validation. DNSSEC is a suite of extensions that add a layer of security to the Domain Name System (DNS) by attaching digital signatures to DNS records to verify their authenticity.

A DNSSEC validation bypass occurs when wildcard expansion proofs, specifically NSEC or NSEC3 records, are accepted without signature validation. This happens when the wildcard answer is a CNAME or DNAME record. DNSSEC (Domain Name System Security Extensions) is a suite of extensions that add a layer of security to the DNS protocol by enabling DNS responses to be digitally signed.

A memory-accounting bypass exists in the downstream DNS-over-QUIC (DoQ) implementation. When DoQ is enabled, the first two bidirectional streams on a new QUIC connection (stream id 0 and 4) bypass the per-stream `quic-size` gate. Large input buffers are allocated after the 2-byte length prefix is received from these initial streams, allowing a remote client to exceed the configured `quic-size` limit with minimal input. By sending a declared 65535-byte length prefix and keeping the streams open, a client can cause the system to allocate approximately double that amount, leading to a denial of service for new DoQ clients. This issue requires the software to be compiled with DoQ support using `--with-libngtcp2` and the `quic-port` to be configured for listening interfaces.

A heap-based buffer overflow occurs when a DNSCrypt query is received over TCP. The routine responsible for encrypting the reply in place does not bound the reply length against the destination buffer size, failing to apply the size clamp used in the UDP path. Consequently, a reply exceeding 65504 bytes is shifted forward by 48 bytes within a buffer of capacity `msg-buffer-size`, resulting in a write operation past the end of the heap allocation. This can be triggered by a single malicious encrypted query, causing the resolver to crash and leading to a denial of service. This issue requires the software to be compiled with DNSCrypt support via `--enable-dnscrypt` and the `dnscrypt:` clause to be configured and enabled for listening interfaces.

Client terminated DNS-over-QUIC (DoQ) queries are not accounted for properly, leading to an inflation of the waiting number of replies for in-flight resolution queries. This causes a degradation of resolution services for new clients. An attacker can trigger this by issuing DoQ queries and immediately terminating them using STOP SENDING, RESET STREAM, or CONNECTION CLOSE QUIC frames. Once the maximum limit is reached, new queries for in-flight resolutions are silently dropped. This issue requires the software to be compiled with DoQ support via `--with-libngtcp2` and the `quic-port` to be configured. Additionally, the attacker must use multiple source IPs to bypass the `wait-limit` option.