Log in Start free

Vulnerability · Published Aug 1, 2022 · Assigned by NLnet Labs

CVE-2022-30698Novel "ghost domain names" attack by introducing subdomain delegations

Medium 6.5

In plain English

A medium-severity security flaw in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.2%top 32.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8python3-unbound1.16.2-2.el8ALSA-2022:7622
AlmaLinux:9python3-unbound1.16.2-2.el9ALSA-2022:8062
AlmaLinux:8unbound1.16.2-2.el8ALSA-2022:7622
AlmaLinux:9unbound1.16.2-2.el9ALSA-2022:8062
AlmaLinux:8unbound-devel1.16.2-2.el8ALSA-2022:7622
AlmaLinux:9unbound-devel1.16.2-2.el9ALSA-2022:8062
AlmaLinux:8unbound-libs1.16.2-2.el8ALSA-2022:7622
AlmaLinux:9unbound-libs1.16.2-2.el9ALSA-2022:8062
Alpine:v3.20unbound1.16.2-r0ALPINE-CVE-2022-30698
Alpine:v3.21unbound1.16.2-r0ALPINE-CVE-2022-30698
Alpine:v3.22unbound1.16.2-r0ALPINE-CVE-2022-30698
Alpine:v3.23unbound1.16.2-r0ALPINE-CVE-2022-30698
Alpine:v3.24unbound1.16.2-r0ALPINE-CVE-2022-30698
Debian:12unbound1.16.2-1DEBIAN-CVE-2022-30698
Debian:13unbound1.16.2-1DEBIAN-CVE-2022-30698
Debian:14unbound1.16.2-1DEBIAN-CVE-2022-30698
Rocky Linux:8unbound0:1.16.2-2.el8RLSA-2022:7622
Rocky Linux:9unbound0:1.16.2-2.el9RLSA-2022:8062
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.1UBUNTU-CVE-2022-30698
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.1USN-5569-1

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound unspecified – through 1.16.1

References