hickory-dns DNS Cache Poisoning via Zone Context Elevation

hickory-dns Vulnerability Summary Vulnerability Overview Vulnerability Name: Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation Vulnerability Type: DNS Cache Poisoning Vulnerability Description: - In the DNS record cache of , records are keyed by the record's own attributes (name, type) rather than by the query that triggered the response. - In the section of , records are iterated over once before insertion. - In the filter, it uses the zone context of the NS record serving the query, rather than the zone being queried. - This creates a cross-zone poisoning path. When builds its NS pool for an attacker, it uses the parent NS pool ( = ). If the section under the namespace contains a record pointing to a sibling zone, such as NS ns.evil.poc., the check passes ( is a subdomain of ). The record is stored in the shared cache with the key . - Subsequently, any client querying the name causes to build its NS pool from the poisoned cache entry, routing queries to the attacker's nameserver ( ) instead of the legitimate nameserver for . The legitimate NS for this zone receives zero queries. Impact Scope Affected Versions: - 0.1 - 0.24.0 - 0.24.1 - 0.24.2 - 0.25.1 - 0.25.2 Fixed Version: None Severity: High CVE ID: No known CVE Weaknesses: - CVE-345 - CVE-706 Remediation Fixed Version: 0.26.0 Fix Details: - Architectural change to response-level caching: responses are keyed by the original query (name, type). - Responses for are stored only under that key and cannot affect cache entries. Recommendations: - The issue exists in all released versions of the crate and has now been merged into the non-default feature flag of the crate. - The crate will no longer receive any updates; all users should migrate to the feature of . - Users of the binary configured with the feature and acting as a recursive resolver should upgrade to version 0.26.0.

Goal Reached Thanks to every supporter — we hit 100%!

hickory-dns DNS Cache Poisoning via Zone Context Elevation

More from this source