A group of researchers from the University of California, Riverside has published a new variant of the SAD DNS attack (CVE-2021-20322) that works despite the protections added last year to block the CVE-2020-25705 vulnerability. The new method is generally similar to last year's vulnerability, differing only in its use of a different type of ICMP packet to check active UDP ports. This proposed attack allows the injection of false data into a DNS server's cache, which can be used to replace the cached IP address of any domain and redirect requests to the attacker’s server.
The proposed method only works within the Linux network stack due to its reliance on a specific characteristic of ICMP packet processing in Linux, which is the source of data leakage that simplifies the determination of the UDP port number used for sending external requests. proxy server Changes to block information leakage were accepted into the Linux kernel at the end of August (the fix is included in kernel version 5.15 and September updates of the LTS kernel branches). The fix entails switching to the use of the SipHash hashing algorithm in network caches instead of Jenkins Hash. The status of addressing the vulnerability in distributions can be assessed on the following pages: Debian, RHEL, Fedora, SUSE, Ubuntu.
According to the researchers who discovered the issue, about 38% of open resolvers on the internet are vulnerable, including popular DNS services like OpenDNS and Quad9 (9.9.9.9). As for server software, the attack can be carried out on Linux servers using packages such as BIND, Unbound, and dnsmasq. The issue does not manifest on DNS servers running with Windows and BSD systems. To successfully execute the attack, IP spoofing must be used, meaning that the attacker's provider must not block packets from a forged source IP address.
Recall that the SAD DNS attack can bypass the protection added to DNS servers to block the classical DNS cache poisoning method proposed by Dan Kaminsky in 2008. Kaminsky's method manipulates the small size of the DNS query ID field, which is only 16 bits. To guess the correct DNS transaction identifier required for spoofing a host name, it's enough to send about 7,000 queries and simulate around 140,000 fake responses. The attack involves sending a large number of packets to the DNS resolver with fake bindings to IP and different DNS transaction IDs. To prevent caching of the first response, each fake response specifies a slightly altered domain name (1.example.com, 2.example.com, 3.example.com, etc.).
To protect against this type of attack, DNS server manufacturers implemented random allocation of source port numbers from which resolving queries are sent, compensating for the inadequately small identifier size. After implementing this protection, in addition to guessing the 16-bit identifier, it became necessary to guess one of 64,000 ports to send a fake response, which increased the number of options for guessing to 2^32.
The SAD DNS method drastically simplifies the identification of the network port number, reducing the attack to Kaminsky's classical method. An attacker can determine traffic to unused and active UDP ports by exploiting information leakage about network port activity when processing response ICMP packets. This method allows reducing the number of guesses by four orders of magnitude — 2^16+2^16 instead of 2^32 (131,072 instead of 4,294,967,296). The leakage of information that enables rapid identification of active UDP ports is caused by shortcomings in the code handling ICMP packets with fragmentation requests (ICMP Fragmentation Needed flag) or redirection (ICMP Redirect flag). Sending such packets alters the cache state in the network stack, allowing the server's response to indicate which UDP port is active and which is not.
Attack Scenario: When a DNS resolver attempts to determine a domain name, it sends a UDP request to the authoritative DNS server. At the moment the resolver is waiting for a response, the attacker can quickly determine the source port number used to send the request and send a spoofed response to it, masquerading as the authoritative DNS server using spoofing. an IP addressThe DNS resolver will cache the data provided in the spoofed response and for some time will return the substituted IP address provided by the attacker for all other DNS queries for the domain name.
Source: opennet.ru
