Bugzilla – Bug 1221164
VUL-0: CVE-2024-1931: unbound: Infinite loop due to improper EDE message size check
Last modified: 2024-06-11 09:53:14 UTC
NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1931 https://www.cve.org/CVERecord?id=CVE-2024-1931 https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt https://bugzilla.redhat.com/show_bug.cgi?id=2268418
The ede_trim_text(..) function is only present in newer unbound versions. Therefore only Factory is affected. commit ccbe31c21f91ae96e759547be264a34ac63f4f90 Author: W.C.A. Wijngaards <wouter@nlnetlabs.nl> Date: Thu Feb 22 16:22:31 2024 +0100 - Fix trim of EDE text from large udp responses from spinning cpu. diff --git a/doc/Changelog b/doc/Changelog index 88c9dbb3..08964afb 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -1,3 +1,6 @@ +22 February 2024: Wouter + - Fix trim of EDE text from large udp responses from spinning cpu. + 20 February 2024: Yorgos - Merge #1010: Mention REFUSED has the TC bit set with unmatched allow_cookie acl in the manpage. It also fixes the code to match the diff --git a/util/data/msgencode.c b/util/data/msgencode.c index 80ae33a3..898ff841 100644 --- a/util/data/msgencode.c +++ b/util/data/msgencode.c @@ -886,6 +886,9 @@ ede_trim_text(struct edns_option** list) curr->opt_len = 2; prev = curr; curr = curr->next; + } else { + prev = curr; + curr = curr->next; } } else { /* continue */
This is an autogenerated message for OBS integration: This bug (1221164) was mentioned in https://build.opensuse.org/request/show/1156332 Factory / unbound
Affected codestreams are fixed
All done, closing.