CVE-2023-50868: Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilities
ISC BIND is vulnerable to a denial of service, caused by an error when preparing an NSEC3 closest encloser proof. By flooding the target resolver with queries, a remote attacker could exploit this vulnerability to cause CPU exhaustion on a DNSSEC-validating resolver.
Other sources
MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU
— Microsoft
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
— Ubuntu
The processing of responses coming from DNSSEC-signed zones using NSEC3 can cause CPU exhaustion on a DNSSEC-validating resolver.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.1.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.1.10.8 - Upgrade
Upgrade
debian/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.49-1~deb12u1Fixed in 1:9.18.49-1~deb12u3Fixed in 1:9.20.26-1~deb13u1Fixed in 1:9.20.30-1~deb13u1Fixed in 1:9.20.30-1 - Upgrade
Upgrade
debian/dnsjavato a version that resolves this vulnerability.Fixed in 3.6.2-2Fixed in 3.6.3-1 - Upgrade
Upgrade
debian/dnsmasqto a version that resolves this vulnerability.Fixed in 2.90-4~deb12u2Fixed in 2.91-1+deb13u2Fixed in 2.91-1+deb13u1Fixed in 2.93-3 - Upgrade
Upgrade
debian/knot-resolverto a version that resolves this vulnerability.Fixed in 5.6.0-1+deb12u1Fixed in 5.7.5-1Fixed in 6.5.0-2 - Upgrade
Upgrade
debian/pdns-recursorto a version that resolves this vulnerability.Fixed in 4.8.8-1+deb12u1Fixed in 5.2.13-0+deb13u1Fixed in 5.4.9-1 - Upgrade
Upgrade
debian/systemdto a version that resolves this vulnerability.Fixed in 252.39-1~deb12u2Fixed in 252.38-1~deb12u1Fixed in 257.13-1~deb13u1Fixed in 262-1Fixed in 262.1-1 - Upgrade
Upgrade
debian/unboundto a version that resolves this vulnerability.Fixed in 1.17.1-2+deb12u4Fixed in 1.17.1-2+deb12u3Fixed in 1.22.0-2+deb13u3Fixed in 1.26.2-0+deb13u1Fixed in 1.26.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-50868?
CVE-2023-50868 is classified as a high severity vulnerability due to its potential for denial of service attacks.
How does CVE-2023-50868 affect DNSSEC-validating resolvers?
CVE-2023-50868 can cause CPU exhaustion on DNSSEC-validating resolvers when exploited by an attacker flooding the resolver with queries.
What are the affected products in CVE-2023-50868?
CVE-2023-50868 affects multiple versions of Microsoft Windows Server, F5 BIG-IP, and several Debian packages such as bind9.
How can I mitigate the impact of CVE-2023-50868?
To mitigate CVE-2023-50868, apply the latest patches provided by the affected software vendors to remediate the vulnerability.
What type of attack is possible due to CVE-2023-50868?
CVE-2023-50868 allows for a denial of service attack, leading to performance issues for affected DNS resolvers.