NLnet Labs Unbound up to 1.21.0 unchecked input for loop condition

Summaryinfo

A vulnerability, which was classified as problematic, has been found in NLnet Labs Unbound up to 1.21.0. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in unchecked input for loop condition. This vulnerability is reported as CVE-2024-8508. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in NLnet Labs Unbound up to 1.21.0. This affects an unknown functionality. The manipulation with an unknown input leads to a unchecked input for loop condition vulnerability. CWE is classifying the issue as CWE-606. The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. This is going to have an impact on availability. The summary by CVE is:

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic.

The weakness was disclosed by Toshifumi Sakaguchi. It is possible to read the advisory at nlnetlabs.nl. This vulnerability is uniquely identified as CVE-2024-8508 since 09/06/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1449 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 208220 (Fedora 40 : unbound (2024-c07e065747)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.21.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208220). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• NLnet Labs

Name

• Unbound

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion