GHSA-8hq4-5836-w6q4: Hickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Record
The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-serverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Hickory DNS hickory-server deployments acting as a validating recursive resolver or validating forwarder are affected if they use versions 0.25.0 before 0.26.2. The issue concerns NXDOMAIN and NODATA responses assembled by those validating roles.
What must an attacker be able to do?
The attacker must be able to supply forged DNS responses to the resolver or forwarder. Successful exploitation can cause a forged SOA record to be returned with the AD bit set.
Why does the AD bit matter in this case?
Clients that rely on the server's DNSSEC validation may interpret the AD bit as confirmation that the response data was DNSSEC-validated. In the affected responses, the SOA record may not actually have been checked.