GHSA-xv7c-h5g9-x25x: Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors
Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using hickory-proto versions 0.25.0-alpha.1 through 0.26.0-alpha.1, or hickory-net versions before 0.26.2, are affected when they perform DNSSEC validation through the vulnerable DS-fetch path.
What does an attacker need to do to trigger the denial of service?
The attacker must induce a SERVFAIL, REFUSED, or timeout response for a child-zone DS sub-query. The validator then caches that transient failure as a Bogus DNSSEC verdict.
How long does the impact last after a successful trigger?
The validator returns SERVFAIL for all names under the affected zone until the relevant cache entry's TTL expires.
What can be done if updating is not immediately possible?
The provided information does not identify a configuration workaround. Operationally, recovery from a triggered condition occurs when the affected cache entry expires.