2024-05-13 10:18:29

by Remi Gacogne

[permalink] [raw]
Subject: [oss-security] PowerDNS Security Advisory 2024-03: Transfer requests received over DoH can lead to a denial of service in DNSdist

Hi all,

We released PowerDNS DNSdist 1.9.4 today. This release fixes
CVE-2024-25581, a denial of service security issue affecting versions
1.9.0, 1.9.1, 1.9.2 and 1.9.3 only. Earlier versions are not affected.

When incoming DNS over HTTPS support is enabled using the nghttp2
provider, and queries are routed to a tcp-only or DNS over TLS backend,
an attacker can trigger an assertion failure in DNSdist by sending a
request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing
the process to stop and thus leading to a Denial of Service.

DNS over HTTPS is not enabled by default, and backends are using plain
DNS (Do53) by default.

Two work-arounds are available:
- refuse incoming XFR requests via a DNSdist rule:
addAction(OrRule({QTypeRule(DNSQType.AXFR), QTypeRule(DNSQType.IXFR)}),
RCodeAction(DNSRCode.REFUSED))
- switch to the legacy h2o provider by setting library='h2o' in the
addDOHLocal directive

We would like to thank Daniel Stirnimann from Switch for finding and
subsequently reporting this issue.

The full security advisory is provided below, and can also be
found at
https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2024-03.html

A minimal patch can also be found here:
https://downloads.powerdns.com/patches/2024-03/

Please feel free to contact me directly if you have any question.

Best regards,

--
Remi Gacogne
PowerDNS.COM BV - https://www.powerdns.com/

PowerDNS Security Advisory 2024-03: Transfer requests received over DoH
can lead to a denial of service in DNSdist
==================================================================================================================

- CVE: CVE-2024-25581
- Date: May 13th 2024
- Affects: PowerDNS DNSdist 1.9.0, 1.9.1, 1.9.2 and 1.9.3, earlier
versions are not affected
- Not affected: PowerDNS DNSdist 1.9.4
- Severity: High (only in specific configurations, see below)
- Impact: Denial of service
- Exploit: This problem can be triggered by a remote, unauthenticated
attacker sending a DNS query
- Risk of system compromise: None
- Solution: Upgrade to patched version or apply the workaround described
below

When incoming DNS over HTTPS support is enabled using the nghttp2
provider, and queries are routed to a tcp-only or
DNS over TLS backend, an attacker can trigger an assertion failure in
DNSdist by sending a request for a zone transfer
(AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus
leading to a Denial of Service.
DNS over HTTPS is not enabled by default, and backends are using plain
DNS (Do53) by default.

`CVSS Score: 7.5
<https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1>`__,
only for configurations where incoming DoH is enabled and a TCP-only/DoT
backend is enabled.

Two workarounds are available:
- refuse incoming XFR requests via a DNSdist rule:
``addAction(OrRule({QTypeRule(DNSQType.AXFR),
QTypeRule(DNSQType.IXFR)}), RCodeAction(DNSRCode.REFUSED))``
- switch to the legacy h2o provider by setting ``library='h2o'`` in the
``addDOHLocal`` directive

For those unable to upgrade to a new version, a minimal patch is
`available for 1.9.3 <https://downloads.powerdns.com/patches/2024-03>`__

We would like to thank Daniel Stirnimann from Switch for finding and
subsequently reporting this issue.


Attachments:
OpenPGP_signature.asc (499.00 B)
OpenPGP digital signature