NLnet Unbound up to 1.19.1 infinite loop

Summaryinfo

A vulnerability has been found in NLnet Unbound up to 1.19.1 and classified as problematic. The impacted element is an unknown function. This manipulation causes infinite loop. This vulnerability is handled as CVE-2024-1931. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in NLnet Unbound up to 1.19.1. It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. The summary by CVE is:

NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely.

The weakness was released 03/07/2024 by Fredrik Pettai. The advisory is shared at nlnetlabs.nl. This vulnerability is known as CVE-2024-1931 since 02/27/2024. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 211409 (Fedora 41 : unbound (2024-5f32029828)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.19.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211409). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• NLnet

Name

• Unbound

Version

• 1.19.0
• 1.19.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion