REDHAT-BUG-2479806: High severity Nlnet Labs Unbound vulnerability
Access of Uninitialized Pointer vulnerability in the DNSSEC validator of the Unbound DNS resolver. The flaw is caused by the use of incorrect counters when calculating write offsets for ADDITIONAL section rrsets in chase-reply messages. DNAME duplication can increase the ANSWER section count and authority filtering can decrease the AUTHORITY section count, creating an uninitialized array slot. The validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Unbound's DNSSEC validator may be exposed when they resolve data from an adversary-controlled DNSSEC-signed domain.
What does an attacker need to do to trigger the failure?
The attacker needs to control a DNSSEC-signed domain and configure a DNAME chain with unsigned CNAMEs. The response must also include unsigned AUTHORITY records and signed ADDITIONAL glue records; a single query can trigger the issue.
What is the expected impact of successful exploitation?
The validator dereferences an uninitialized pointer and immediately crashes the Unbound process.