REDHAT-BUG-2458516: High severity Nlnet Labs Unbound vulnerability
NSEC/NSEC3 bitmap window iteration in dnssec.c advances by p[1] instead of p[1] + 2, missing the 2-byte window header. When bitmaplength=0, neither rdlen nor p change, creating an infinite loop. Two instances at dnssec.c:1290 and dnssec.c:1450. Reachable before RRSIG validation so no valid signatures are needed. One of the two sites was coincidentally fixed in 2.92. Fix: add +2 to both the pointer advance and rdlen decrement.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need to provide a valid DNSSEC signature to trigger this issue?
No. The affected parsing paths are reachable before RRSIG validation, so valid signatures are not required.
What malformed DNSSEC data causes the affected resolver to loop?
An NSEC or NSEC3 bitmap window with bitmap_length set to 0 can leave both the remaining record length and parsing pointer unchanged, causing an infinite loop.
Are there multiple affected parsing locations?
Yes. The issue occurs at two locations in dnssec.c, at lines 1290 and 1450. One location was coincidentally fixed in version 2.92, while the complete fix adds 2 bytes for the window header to both pointer advancement and remaining-length reduction.