- Reported
-
- Issued
-
- Package
-
hickory-net
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dns
#dnssec
#nsec
#nsec3
- Aliases
-
- References
-
- CVSS Score
- 5.9
MEDIUM
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- High
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Patched
-
Description
To show that a delegation is insecure, a validator needs proof that the parent zone has no DS record for it. That proof must come from the parent side of the zone cut: RFC 4035 section 5.2, RFC 5155 section 8.9 and RFC 6840 section 4.4 require the matching NSEC or NSEC3 record not to have the SOA bit set, since a record with SOA comes from the child zone's apex.
DNSSEC validation did not check this. An attacker who can answer or modify DNS responses can answer a DS query with the child zone's own signed NSEC or NSEC3 record for its apex, which does not list DS, and have the validator accept that the delegation is insecure. Records in the child zone can then be forged without any signature.
This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.
The fix treats a NODATA proof for a DS query as bogus when the directly matching NSEC or NSEC3 record has SOA in its type bitmap. It is in 0.26.2.
Advisory available under CC0-1.0
license.