REDHAT-BUG-2479774: High severity Nlnet Labs Unbound vulnerability
A vulnerability was found in Unbound that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited.
Unbound 1.25.1 includes a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation that also contributes to the heap overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unboundto a version that resolves this vulnerability.Fixed in 1.25.1 - Configuration
Disable the 'nsid' option to prevent exploitation (vulnerability requires 'nsid' among the relevant options).
Unbound nsid = disable - Configuration
Disable the 'answer-cookie' option to prevent exploitation (vulnerability requires 'answer-cookie' among the relevant options).
Unbound answer-cookie = disable - Configuration
Disable 'pad-responses' (noting it is a default option) to prevent exploitation (vulnerability requires 'pad-responses' among the relevant options).
Unbound pad-responses = disable
Event History
Frequently Asked Questions
Which configurations are exposed to this issue?
Exploitation requires relevant EDNS reply options to be enabled: nsid, answer-cookie, and/or pad-responses. The pad-responses option is enabled by default, so default configurations may be affected.
What does an attacker need to trigger the vulnerability?
An attacker needs to cause Unbound to encode multiple NSID, DNS Cookie EDNS, and/or EDNS Padding options in a reply packet. The issue occurs during reply-packet encoding when the relevant options are enabled.
What remediation is identified?
Unbound 1.25.1 includes fixes that de-duplicate EDNS options and prevent truncation in EDNS field-size calculation, addressing contributing conditions for the heap overflow.