#VU66548 Predictable from Observable State in Unbound

Published: 2022-08-16

Vulnerability identifier: #VU66548

Vulnerability risk: Medium


CVE-ID: CVE-2022-30698


Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Server applications / DNS servers

Vendor: NLnet Labs


The vulnerability allows a remote attacker to poison DNS cache.

The vulnerability exists due to the way Unbound handles delegation information expiration event. A remote attacker who controls a rouge DNS server can force the Unbound instance to cache incorrect information about subdomain delegation and permanently poison the DNS cache, e.g. perform the "ghost domain names" attack. 

The attack is carried out when Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation.

Install updates from vendor's website.

Vulnerable software versions

Unbound: 1.0.0 - 1.16.1 rc1


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability