Log in Start free

Vulnerability · Published Sep 26, 2022 · Assigned by NLnet Labs

CVE-2022-3204NRDelegation Attack

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Unbound from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.6%top 23.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8python3-unbound1.16.2-5.el8ALSA-2023:2771
AlmaLinux:9python3-unbound1.16.2-3.el9ALSA-2023:2370
AlmaLinux:8unbound1.16.2-5.el8ALSA-2023:2771
AlmaLinux:9unbound1.16.2-3.el9ALSA-2023:2370
AlmaLinux:8unbound-devel1.16.2-5.el8ALSA-2023:2771
AlmaLinux:9unbound-devel1.16.2-3.el9ALSA-2023:2370
AlmaLinux:8unbound-libs1.16.2-5.el8ALSA-2023:2771
AlmaLinux:9unbound-libs1.16.2-3.el9ALSA-2023:2370
Alpine:v3.20unbound1.16.3-r0ALPINE-CVE-2022-3204
Alpine:v3.21unbound1.16.3-r0ALPINE-CVE-2022-3204
Alpine:v3.22unbound1.16.3-r0ALPINE-CVE-2022-3204
Alpine:v3.23unbound1.16.3-r0ALPINE-CVE-2022-3204
Alpine:v3.24unbound1.16.3-r0ALPINE-CVE-2022-3204
Debian:12unbound1.16.3-1DEBIAN-CVE-2022-3204
Debian:13unbound1.16.3-1DEBIAN-CVE-2022-3204
Debian:14unbound1.16.3-1DEBIAN-CVE-2022-3204
Rocky Linux:8unbound0:1.16.2-5.12.el8_10RLSA-2023:2771
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.3UBUNTU-CVE-2022-3204
Ubuntu:22.04:LTSunbound1.13.1-1ubuntu5.3USN-5732-1

Affected products (as reported)

VendorProductVersions
NLnet Labs Unbound unspecified – through 1.16.2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References