AI analysis
Unbound, NLnet Labs' widely used validating recursive DNS resolver, contains a buffer overflow (CWE-122) in the DNSSEC validator's DNSKEY digesting routine. A crafted DNSKEY record whose owner name uses a compression pointer back into its own RDATA overflows the digest buffer while the resolver is validating the zone. An attacker who controls a malicious authoritative zone and can cause a vulnerable Unbound resolver to query it can crash the service (denial of service) and, using attacker-controlled data, potentially achieve remote code execution on the resolver host. All Unbound deployments up to and including version 1.26.0 that perform DNSSEC validation are affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in CISA's KEV catalog.
What to do: Upgrade Unbound to the patched release announced by NLnet Labs (any version beyond 1.26.0 containing the fix) as soon as it is available, and confirm the running version with 'unbound -V'. Until patching, restrict recursion to trusted clients, monitor NLnet Labs' advisory for fixed versions and workarounds, and treat unexplained resolver crashes or restarts as suspicious.
Affected
| NLnet Labs Unbound | up to and including 1.26.0 |
Estimated exposure
massmillions of installations worldwide, including hundreds of thousands of internet-reachable Unbound resolvers seen in public scans — Unbound is one of the most widely deployed open-source validating recursive resolvers, bundled by default in several Linux/BSD distributions and common at ISPs, registrars and enterprises, so the order of magnitude of affected…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.