Yuqi Qiu

Zones configured with `zonemd-check: yes` that are located below a trust anchor contain a flaw where tampered zone contents may be served or stored to disk before the ZONEMD integrity check is completed. This occurs due to the asynchronous resolution of DS/DNSKEY records required for the check. If the `zonefile:` option is used to write a zonefile to disk while the ZONEMD check fails, the tampered data is reloaded upon startup and remains available until the next verification concludes. Even if verification subsequently fails, the tampered data persists on disk for future reloads.

A use-after-free issue occurs when the software is compiled for DNS-over-QUIC (DoQ) support using the `--with-libngtcp2` flag. In this configuration, each DoQ stream utilizes an output buffer for DNS responses. The `ngtcp2` retransmission buffer maintains a shallow pointer to this output buffer. When a client sends a RESET STREAM, the output buffer is freed, but `ngtcp2` retains the retransmission entries. A subsequent Probe Timeout (PTO) triggers `ngtcp2` to re-encode the STREAM frame and copy data from the already freed buffer. An unprivileged remote actor can trigger this by querying Unbound over DoQ, withholding acknowledgments, and sending a RESET STREAM. This can result in an abnormal server exit.

A heap-based buffer overflow exists in the DNSSEC validator of the Unbound DNS resolver. The issue occurs during the preparation of a DNSKEY digest within the `ds create dnskey digest()` function located in `validator/val sigcrypt.c`. An attacker controlling a malicious DNS zone can trigger this by providing a DNSKEY record where the owner compression pointer refers to its own RDATA. This causes the validator to decompress the data into a buffer without a proper capacity check, leading to a memory boundary crossing. This can result in a denial of service or possible remote code execution (RCE) within the resolver process, requiring no target credentials or user interaction.

A use-after-free issue occurs when the software is compiled for DNS-over-HTTPs (DoH) support using the `--with-libnghttp2` flag. During failure code paths, such as an RPZ drop query or jostle caused by heavy traffic, a dropped DoH stream can terminate the entire DoH session without properly accounting for other active streams in that same session. A malicious actor can trigger this condition with a single DoH connection and specific traffic, provided the prerequisites are met. While the impact is limited because reads are not user-controlled and typically result in early returns, a hardened allocator may detect the use-after-free and terminate the process, leading to a denial of service.