CVE-2012-0024 in MaraDNS
Summary
by MITRE
MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/28/2021
The vulnerability identified as CVE-2012-0024 affects MaraDNS versions prior to 1.3.07.12 and 1.4.x versions prior to 1.4.08, representing a critical weakness in the domain name system implementation that exposes the software to predictable hash collision attacks. This flaw resides in the DNS data hashing mechanism where the system fails to implement proper collision resistance measures, creating an avenue for malicious actors to exploit the underlying hash table structure through carefully crafted DNS queries. The vulnerability specifically targets the recursion desired bit within DNS packets, which when set in multiple crafted requests can trigger systematic hash table collisions that consume excessive computational resources.
The technical flaw manifests in the hash function implementation within MaraDNS where the algorithm does not adequately randomize or salt hash computations, allowing attackers to construct DNS queries that deliberately map to the same hash bucket. This predictable collision behavior transforms what should be efficient O(1) hash table lookups into O(n) linear searches, where n represents the number of elements in the colliding bucket. When multiple crafted queries are sent with the recursion desired bit set, each query triggers the same hash collision pattern, causing the DNS server to process these requests inefficiently and consume disproportionate CPU cycles. The attack leverages the fundamental weakness in the hash table implementation by exploiting the deterministic nature of the hash function without proper collision handling mechanisms.
The operational impact of this vulnerability creates a severe denial of service condition where legitimate DNS queries become increasingly difficult to process as the hash table becomes increasingly congested with colliding entries. Attackers can maintain sustained resource exhaustion by continuously sending crafted queries, effectively making the DNS service unavailable to legitimate users while consuming significant computational resources. The vulnerability affects DNS resolution performance across the entire MaraDNS deployment, potentially causing cascading failures in dependent services that rely on timely DNS resolution. Network administrators may observe sustained high CPU utilization on affected DNS servers, with the system becoming unresponsive to legitimate queries as the hash table degrades into a linear search structure.
Mitigation strategies for this vulnerability require immediate patching of MaraDNS installations to versions 1.3.07.12 or 1.4.08 and later, which contain fixed hash table implementations that prevent predictable collision patterns. Organizations should implement rate limiting mechanisms to restrict the number of queries with the recursion desired bit set from any single source, effectively reducing the impact of sustained attacks. Network-level protections including firewall rules that limit DNS query volume and monitoring systems that detect unusual CPU consumption patterns can provide additional defense layers. The fix addresses the core issue by implementing proper hash function randomization and collision handling that ensures uniform distribution of hash values even when subjected to adversarial input patterns. This vulnerability aligns with CWE-327, which addresses weak cryptographic hash functions, and maps to ATT&CK technique T1499.004 for network denial of service attacks, demonstrating how predictable hash collisions can be weaponized for resource exhaustion attacks against DNS infrastructure.