Resource management error in knot-resolver - CVE-2019-19331
Published: August 3, 2020
Vulnerability identifier: #VU32984
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19331
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
Affected software
knot-resolver
knot-resolver (Alpine package)
knot-resolver (Ubuntu package)
knot-resolver
Fedora
Ubuntu
knot-resolver (Alpine package)
knot-resolver (Ubuntu package)
knot-resolver
Fedora
Ubuntu
How to mitigate CVE-2019-19331
Install updates from vendor's website.
knot-resolver - update to 4.3.0
knot-resolver (Alpine package) - update to 4.3.0-r0
knot-resolver (Ubuntu package) - update to 3.2.1-3ubuntu2.2
knot-resolver - addressed in versions 4.3.0-1.el7, 4.3.0-1.fc30, 4.3.0-1.fc31
knot-resolver (Alpine package) - update to 4.3.0-r0
knot-resolver (Ubuntu package) - update to 3.2.1-3ubuntu2.2
knot-resolver - addressed in versions 4.3.0-1.el7, 4.3.0-1.fc30, 4.3.0-1.fc31