- Reported
-
- Issued
-
- Package
-
hickory-net
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dns
#dnssec
#nsec
- Aliases
-
- References
-
- Patched
-
Description
At a delegation, the parent zone signs an NSEC record for the child's name whose type bitmap has NS but not SOA (or has DNAME). RFC 6840 section 4.1 says such a record only proves that no DS record exists at that name. It says nothing about names below the cut or about other types at the cut, because those belong to the child zone.
DNSSEC validation did not make this distinction. It used such a record as a covering NSEC for names below the cut, and as a direct match proving that other types did not exist at the cut. An attacker who can answer or modify DNS responses can replay the parent's genuine signed records to get an NXDOMAIN or NODATA response for an existing name in the child zone accepted as secure. A recursor caches that denial for the negative TTL.
This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.
The fix adds NSEC::is_ancestor_delegation() in hickory-proto. Validation no longer uses such a record to cover a name below its owner, and treats a direct match on it as bogus unless the query is for DS. It is in 0.26.2.
Advisory available under CC0-1.0
license.