{"id":113594,"date":"2024-02-14T22:02:42","date_gmt":"2024-02-14T20:02:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec"},"modified":"2024-02-14T22:02:42","modified_gmt":"2024-02-14T20:02:42","slug":"uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","title":{"rendered":"KeyTrap and NSEC3 vulnerabilities affecting most DNSSEC implementations","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Two vulnerabilities have been identified in various DNSSEC protocol implementations, impacting BIND, PowerDNS, dnsmasq, Knot Resolver, and Unbound DNS resolvers. These vulnerabilities can lead to denial of service for DNS resolvers performing validation with DNSSEC due to high CPU load, hindering the processing of other requests. The attacker only needs to send a request to a DNS resolver using DNSSEC that results in a query to a specially crafted DNS zone on the attacker's server. <\/p>\n
Identified issues: <\/p>\n
\n
CVE-2023-50387 (codename KeyTrap) \u2014 accessing specially crafted DNS zones leads to denial of service due to significant CPU load and prolonged DNSSEC verification. To carry out the attack, an attacker must host a domain zone with malicious settings on a DNS server under their control and cause a recursive DNS server to query that zone, achieving denial of service.\n
Malicious settings involve using a combination of conflicting keys, RRSET records, and digital signatures for the zone. Attempting validation with these keys results in long, resource-intensive operations that can fully utilize the CPU and block the processing of other requests (for instance, it is reported that during an attack on BIND, processing of other requests was halted for 16 hours). <\/p>\n
CVE-2023-50868 (codename NSEC3) \u2014 denial of service due to extensive computations required for hashing in NSEC3 (Next Secure v3) records when processing specially crafted DNSSEC responses. The attack method is similar to the first vulnerability, except that the attacker creates a specially crafted set of NSEC3 RRSET records on the malicious DNS server. <\/ul>\n
It is noted that the emergence of the aforementioned vulnerabilities is due to the specification in DNSSEC allowing DNS servers to send all available cryptographic keys, while resolvers are required to process any keys received until validation is either successful or all received keys have been verified. <\/p>\n
To mitigate vulnerabilities in resolvers, the maximum number of DNSSEC keys involved in building the chain of trust has been limited, and the maximum number of hash calculations for NSEC3 has also been restricted, as well as limiting the number of retry attempts for each RRSET (combinations of keys and signatures) and each response. server<\/a>. <\/p>\n