#VU66548 Predictable from Observable State in Unbound - CVE-2022-30698

Vulnerability identifier: #VU66548

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-30698

CWE-ID: CWE-341

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Unbound

Software vendor:
NLnet Labs

The vulnerability allows a remote attacker to poison DNS cache.

The vulnerability exists due to the way Unbound handles delegation information expiration event. A remote attacker who controls a rouge DNS server can force the Unbound instance to cache incorrect information about subdomain delegation and permanently poison the DNS cache, e.g. perform the "ghost domain names" attack. 

The attack is carried out when Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation.

Install updates from vendor's website.

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txt
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5L3ZFWZZFPBIL654BG75RWXUMPFQJ5EC/