Double trouble for DNSSEC though the devil is in the details

Updated Two DNSSEC vulnerabilities were disclosed last month with similar descriptions and the same severity score, but they are not the same issue. One, named KeyTrap (CVE-2023-50387) by Germany’s National Research Centre for applied cybersecurity (ATHENE), was described as "one of the worst ever discovered," by Akamai exec Sven Dummer, because it could be used to disable large portions of the internet. KeyTrap allowed a single DNS packet to deny service by exhausting the CPU resources of machines running DNSSEC-validated DNS services, such as those provided by Google and Cloudflare. DNSSEC (Domain Name System Security Extensions) offers a cryptographic way to protect DNS interactions. But its implementation specification failed to account for the possibility of maliciously crafted packets that could force a responder to tie itself in knots doing obligatory calculations. The other DNSSEC flaw, NSEC3-encloser (CVE-2023-50868), was found by Petr Špaček from the Internet Systems Consortium (ISC) and was also presented as a CPU exhaustion risk. But based on an analysis conducted by the ATHENE team, it now looks largely inconsequential. Both earned a severity rating of 7.5 out of 10 under the Common Vulnerability Scoring System (CVSS) by MITRE, the nonprofit security outfit that operates US federally funded research and development centers. The two flaws were also described in advisories from the ISC, maker of affected BIND 9 DNS software, using identical terms. The CVEs for KeyT...