Xiang Li

A heap-based buffer overflow exists in the DNSSEC validator of the Unbound DNS resolver. The issue occurs during the preparation of a DNSKEY digest within the `ds create dnskey digest()` function located in `validator/val sigcrypt.c`. An attacker controlling a malicious DNS zone can trigger this by providing a DNSKEY record where the owner compression pointer refers to its own RDATA. This causes the validator to decompress the data into a buffer without a proper capacity check, leading to a memory boundary crossing. This can result in a denial of service or possible remote code execution (RCE) within the resolver process, requiring no target credentials or user interaction.

Algorithmic complexity attacks, researched as 'ReTrap', can lead to service degradation when malicious zones are used. These attacks include TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism is exploited via responses with numerous mismatched DNSKEY, RRSIG, and DS records; DelegationTrap, which causes computational overhead during the iterative validation of the chain-of-trust for deeply nested domains; NsecTrap, which forces the resolver to validate excessive invalid NSEC records; and AdditionalTrap, where the default DNSSEC validation of the ADDITIONAL section is used to waste resources.

A use-after-free issue occurs when the software is compiled for DNS-over-HTTPs (DoH) support using the `--with-libnghttp2` flag. During failure code paths, such as an RPZ drop query or jostle caused by heavy traffic, a dropped DoH stream can terminate the entire DoH session without properly accounting for other active streams in that same session. A malicious actor can trigger this condition with a single DoH connection and specific traffic, provided the prerequisites are met. While the impact is limited because reads are not user-controlled and typically result in early returns, a hardened allocator may detect the use-after-free and terminate the process, leading to a denial of service.

A use-after-free issue occurs when the software is compiled for DNS-over-QUIC (DoQ) support using the `--with-libngtcp2` flag. In this configuration, each DoQ stream utilizes an output buffer for DNS responses. The `ngtcp2` retransmission buffer maintains a shallow pointer to this output buffer. When a client sends a RESET STREAM, the output buffer is freed, but `ngtcp2` retains the retransmission entries. A subsequent Probe Timeout (PTO) triggers `ngtcp2` to re-encode the STREAM frame and copy data from the already freed buffer. An unprivileged remote actor can trigger this by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET STREAM. This can result in an abnormal server exit.

Zones configured with `zonemd-check: yes` that are located below a trust anchor contain a flaw where tampered zone contents may be served or stored to disk before the ZONEMD integrity check is completed. This occurs due to the asynchronous resolution of DS/DNSKEY records required for the check. If the `zonefile:` option is used to write a zonefile to disk while the ZONEMD check fails, the tampered data is reloaded upon startup and remains available until the next verification concludes. Even if verification subsequently fails, the tampered data persists on disk for future reloads.

An attacker spoofing responses to ECS-enabled requests sent by the Recursor may succeed. The updated version includes mitigations against spoofing attempts of ECS-enabled queries by chaining ECS-enabled requests and enforcing stricter validation of received responses. The most strict mitigation is enabled when the `outgoing.edns subnet harden` setting is enabled.

A multi-vendor cache poisoning vulnerability, named 'Rebirthday Attack', has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is vulnerable when compiled with ECS support (i.e., '--enable-subnet') and configured to send ECS information to upstream name servers (i.e., at least one of the 'send-client-subnet', 'client-subnet-zone', or 'client-subnet-always-forward' options is used). This allows malicious actors to potentially match DNS transaction IDs and cache poisonous replies.

An issue was discovered in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

An issue in the forwarding mode enables attackers to create a query loop using Technitium resolvers, launching amplification attacks and potentially causing denial-of-service (DoS).

An issue in the software enables attackers to launch amplification attacks, potentially causing denial-of-service (DoS) with an amplification factor three times higher than other software like BIND.

The issue enables attackers to conduct a DNS cache poisoning attack, allowing them to inject fake responses within 1 second.

The issue allows attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack, enabling them to manipulate DNS responses.

The issue is related to the DNS protocol, which allows remote attackers to cause a denial of service by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst. This can be considered traffic amplification in some cases, also known as the "DNSBomb" issue. The attack works by sending a slow stream of modified DNS requests to DNS servers, which relay the data, increasing the packet size and holding it to then release all at once in a burst of DNS traffic directly at the target. The research group claims to have tested their technique on 10 major DNS programs and 46 public DNS services and was able to launch DNSBomb at a rate of up to 8.7 Gbit/s, with DNS traffic increased up to 20,000 times its original size.

The issue is related to errors in the representation of information by the user interface in the Windows DNS service. This can allow a remote attacker to conduct spoofing attacks.

The issue is related to a denial of service vulnerability in the c-ares library, which is an asynchronous resolver library. It occurs when a target resolver sends a query, and an attacker forges a malformed UDP packet with a length of 0, causing the target resolver to interpret the 0 length as a graceful shutdown of the connection. This can lead to a denial of service.

The issue is related to a denial of service vulnerability in PowerDNS Recursor, where authoritative servers can be marked as unavailable. This can be exploited by a remote attacker to cause a denial of service.

The issue enables attackers to consume the resolver's resources, launching amplification attacks and potentially causing a denial of service. A single client query may lead to a hundred TCP connection attempts if a DNS server closes connections without providing a response.

The issue allows a self-CNAME denial-of-service attack. This occurs when a CNAME loop causes an answer to contain hundreds of records.

An issue was discovered that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.

An issue was discovered that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.