Denial of Service Vulnerability in Unbound DNS Resolver
Summary
DEBIAN-CVE-2024-8508: NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Affects unbound versions < 1.13.1-1+deb11u4. Fixed in 1.13.1-1+deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Unbound is a validating, recursive, and caching DNS resolver developed by NLnet Labs. It is designed to provide secure and efficient DNS resolution services. Unbound is widely used in various environments due to its performance and security features. However, it is susceptible to a vulnerability that can lead to degraded performance and denial of service when handling large Resource Record sets (RRsets).
Vulnerability Detail
NLnet Labs Unbound versions up to and including 1.21.0 contain a vulnerability that arises when processing replies with very large RRsets requiring name compression. Malicious responses from upstream servers with oversized RRsets can cause Unbound to spend excessive time applying name compression to downstream replies. This unbounded operation can lead to CPU locking, resulting in degraded performance and potential denial of service during coordinated attacks. The vulnerability can be exploited by malicious actors querying Unbound for specially crafted contents of a malicious zone with large RRsets.
How To Fix
Minimum fixed version
1.13.1-1+deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unboundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider limiting the number of queries to Unbound or implementing rate limiting on the DNS server to mitigate potential denial of service attacks.
Conclusion
The vulnerability in Unbound DNS Resolver poses a significant risk of denial of service due to its handling of large RRsets. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for unbound →
FAQ
The vulnerability can lead to degraded performance and denial of service, especially during coordinated attacks using malicious DNS responses.
You can check your version of Unbound by running 'unbound -V' in the terminal. If it is below the patched versions mentioned, it is affected.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application against this vulnerability using the Vulert playground.
Implement rate limiting on your DNS server or restrict the number of queries to mitigate the risk of exploitation until you can apply the patch.
Detailed information can be found in the Debian CVE database or by visiting the official NLnet Labs Unbound documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for unbound.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
