Two vulnerabilities have been identified in various DNSSEC protocol implementations, impacting BIND, PowerDNS, dnsmasq, Knot Resolver, and Unbound DNS resolvers. These vulnerabilities can lead to denial of service for DNS resolvers performing validation with DNSSEC due to high CPU load, hindering the processing of other requests. The attacker only needs to send a request to a DNS resolver using DNSSEC that results in a query to a specially crafted DNS zone on the attacker's server.
Identified issues:
- CVE-2023-50387 (codename KeyTrap) — querying specially crafted DNS zones leads to denial of service by creating significant CPU load and prolonged DNSSEC validation times. To carry out the attack, the attacker needs to host a domain zone with malicious settings on a DNS server under their control and ensure that a recursive DNS server queries this zone, which is the target of the denial of service attack.
Malicious settings involve using a combination of conflicting keys, RRSET records, and digital signatures for the zone. Attempting validation with these keys results in long, resource-intensive operations that can fully utilize the CPU and block the processing of other requests (for instance, it is reported that during an attack on BIND, processing of other requests was halted for 16 hours).
- CVE-2023-50868 (codename NSEC3) — denial of service due to significant computations when calculating hashes in NSEC3 (Next Secure v3) records while processing specially crafted DNSSEC responses. The attack methodology is similar to the first vulnerability, except that a specially crafted set of NSEC3 RRSET records is created on the attacker's DNS server.
It is noted that the emergence of the aforementioned vulnerabilities is due to the specification in DNSSEC allowing DNS servers to send all available cryptographic keys, while resolvers are required to process any keys received until validation is either successful or all received keys have been verified.
To mitigate vulnerabilities in resolvers, the maximum number of DNSSEC keys involved in building the chain of trust has been limited, and the maximum number of hash calculations for NSEC3 has also been restricted, as well as limiting the number of retry attempts for each RRSET (combinations of keys and signatures) and each response. server.
Vulnerabilities have been resolved in the updates for Unbound (1.19.1), PowerDNS Recursor (4.8.6, 4.9.3, 5.0.2), Knot Resolver (5.7.1), dnsmasq (2.90), and BIND (9.16.48, 9.18.24, and 9.19.21). The vulnerability resolution status in distributions can be evaluated on these pages: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware, NetBSD, FreeBSD.
In versions of the BIND DNS server 9.16.48, 9.18.24, and 9.19.21, several additional vulnerabilities have been addressed:
- CVE-2023-4408 — parsing large DNS messages may lead to a significant CPU load.
- CVE-2023-5517 — a request for a specially crafted reverse zone may lead to a crash due to an assert check triggering. This issue only manifests in configurations with the 'nxdomain-redirect' setting enabled.
- CVE-2023-5679 — recursive host resolution may lead to a crash due to an assert check triggering on systems with DNS64 support and 'serve-stale' enabled (settings, stale-cache-enable and stale-answer-enable).
- CVE-2023-6516 — specially crafted recursive queries may lead to the exhaustion of available process memory.
Source: opennet.ru
