Taofei Guo

An observable cache-level side-channel exists when the `unwanted-reply-threshold` is configured to a value greater than 0. This occurs when a response-like UDP datagram reaches the upstream source port of a recursive query but has a `TXID` that does not match any pending query, causing Unbound to count it as an unwanted reply. Once the accumulated count reaches the configured threshold, the worker's RRset cache and message cache are cleared without destroying the current upstream UDP pending query. An external observer can use this behavior to determine if a candidate port matches the current upstream source port by monitoring if cached items are cleared. This side-channel can be used to probe the upstream source port and, in scenarios where a concurrent query window is maintained, facilitate birthday-style guessing against the `TXID` to enable cache poisoning.

An issue exists where promiscuous RRSets (Resource Record Sets) that complement DNS replies in the authority section can be used to trick the system into caching unauthorized records. An adversary can poison the cache by attaching such records to a reply via spoofed packets or fragmentation attacks. Specifically, a malicious actor can inject RRSets other than NS (Name Server), such as MX (Mail Exchange), accompanied by address records in a reply. The system may then accept and cache relative address records from the additional section if the authority RRSet possesses sufficient trust, such as in-zone data for the delegation point.

Improperly crafted zones may cause increased resource consumption. Additionally, crafted CNAME chains can lead to cache poisoning within the Recursor.

Unbound is susceptible to domain hijack attacks through the manipulation of DNS responses. Specifically, maliciously crafted NS Resource Record Sets (RRSets) included in replies can cause the resolver to update its delegation information, potentially leading to a zone transfer. An attacker could exploit this by injecting NS RRSets, possibly through packet spoofing or fragmentation attacks, causing Unbound to update its existing NS RRSet data due to the perceived trustworthiness of the injected information.