CVE-2021-23017: F5 Nginx Buffer Overflow Vulnerability

CVE-2021-23017 Overview

A security vulnerability exists in the nginx resolver component that allows an attacker capable of forging UDP packets from a DNS server to cause a 1-byte memory overwrite. This off-by-one error (CWE-193) can result in worker process crashes or potentially enable more severe exploitation scenarios including arbitrary code execution.

Critical Impact

Network-accessible vulnerability in nginx resolver enables memory corruption through forged DNS responses, potentially leading to denial of service or remote code execution on affected web servers.

Affected Products

• F5 Nginx (multiple versions)
• OpenResty
• Fedora 33 and 34
• NetApp ONTAP Select Deploy Administration Utility
• Oracle Blockchain Platform
• Oracle Communications Control Plane Monitor (versions 3.4, 4.2, 4.3, 4.4)
• Oracle Communications Fraud Monitor
• Oracle Communications Operations Monitor (versions 3.4, 4.2, 4.3, 4.4)
• Oracle Communications Session Border Controller (versions 8.4, 9.0)
• Oracle Enterprise Communications Broker (version 3.3.0)
• Oracle Enterprise Session Border Controller (versions 8.4, 9.0)
• Oracle Enterprise Telephony Fraud Monitor (versions 3.4, 4.2, 4.3, 4.4)
• Oracle GoldenGate

Discovery Timeline

• 2021-06-01 - CVE-2021-23017 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23017

Vulnerability Analysis

This vulnerability affects the DNS resolver functionality within nginx. When nginx is configured to use DNS resolution (via the resolver directive), it processes DNS response packets from configured DNS servers. The flaw exists in how nginx handles these DNS responses, specifically in the parsing of DNS labels.

The vulnerability is classified as an off-by-one error (CWE-193), where a boundary calculation error leads to writing a single byte beyond the intended buffer boundary. While a 1-byte overwrite may seem limited in scope, memory corruption vulnerabilities of this nature can be leveraged by sophisticated attackers to achieve more significant impact, including arbitrary code execution under certain memory layout conditions.

The attack requires the adversary to position themselves as a man-in-the-middle or compromise/spoof the DNS server that nginx queries. This network-based attack vector means any nginx instance performing DNS resolution and exposed to potentially malicious DNS traffic is at risk.

Root Cause

The root cause is an off-by-one error in the nginx resolver code when processing DNS response packets. Specifically, the vulnerability occurs during the handling of DNS name compression pointers or label length calculations. The boundary check fails to properly account for all bytes, resulting in a write operation that exceeds the allocated buffer by exactly one byte.

This type of error typically occurs when:

• Loop termination conditions are incorrect (using <= instead of < or vice versa)
• Buffer size calculations don't account for null terminators or length bytes
• Pointer arithmetic errors in DNS label decompression routines

Attack Vector

The attack vector is network-based and exploits the DNS resolution process. An attacker must be able to inject or forge UDP packets that appear to originate from a legitimate DNS server. This can be accomplished through:

1. DNS Server Compromise: Gaining control of a DNS server configured in nginx's resolver directive
2. Man-in-the-Middle Attack: Intercepting and modifying DNS traffic between nginx and legitimate DNS servers
3. DNS Spoofing: Sending forged UDP packets with spoofed source IP addresses matching the configured DNS server

Once positioned, the attacker crafts a malicious DNS response containing specifically structured data that triggers the off-by-one write. The 1-byte overwrite corrupts adjacent memory, which can cause the nginx worker process to crash (denial of service) or, in more sophisticated attacks, may be chained with other techniques to achieve code execution.

The vulnerability is particularly concerning because:

• DNS queries often occur during normal proxy operations
• UDP-based DNS is susceptible to spoofing attacks
• Many nginx deployments use the resolver directive for dynamic upstream resolution

Detection Methods for CVE-2021-23017

Indicators of Compromise

• Unexpected nginx worker process crashes or restarts, particularly when processing requests requiring DNS resolution
• Anomalous DNS response packets with unusual label structures or sizes in network traffic captures
• Memory corruption indicators in nginx error logs or core dumps showing heap/buffer corruption patterns
• Unusual DNS traffic patterns from unexpected source addresses targeting nginx servers

Detection Strategies

• Monitor nginx error logs for segmentation faults, worker process crashes, or memory-related errors occurring during DNS resolution
• Implement network-based detection rules to identify malformed DNS responses with suspicious label lengths or compression pointers
• Deploy intrusion detection signatures matching known exploitation patterns for CVE-2021-23017 (reference the Packet Storm DoS Report for indicators)
• Use runtime application self-protection (RASP) or memory protection tools to detect buffer overflows in nginx processes

Monitoring Recommendations

• Enable nginx debug logging for resolver operations when investigating potential compromise
• Configure SIEM alerts for nginx worker process restart frequency exceeding baseline thresholds
• Monitor DNS query/response traffic for anomalies in packet size, response timing, or source authenticity
• Implement DNS traffic validation at network perimeter to filter obviously malformed responses

How to Mitigate CVE-2021-23017

Immediate Actions Required

• Upgrade nginx to a patched version immediately; refer to the Nginx Security Announcement for fixed versions
• If using OpenResty, apply vendor patches as documented in their security advisories
• Review and restrict DNS resolver configurations to trusted internal DNS servers only
• Implement network segmentation to limit potential DNS spoofing attack surfaces

Patch Information

F5/nginx has released security patches addressing this vulnerability. The fix corrects the boundary calculation error in the DNS resolver code, ensuring proper buffer size validation during DNS response processing.

For Oracle products, consult the following security advisories for patched versions:

• Oracle Security Alert October 2021
• Oracle Security Alert January 2022
• Oracle Security Alert April 2022

For NetApp products, review the NetApp Security Advisory. Fedora users should apply updates via standard package management as documented in the Fedora Package Announcements.

Workarounds

• Remove or comment out resolver directives in nginx configuration if dynamic DNS resolution is not required for your deployment
• Use static upstream IP addresses instead of hostnames to eliminate DNS resolution dependency
• Deploy DNS traffic filtering at network boundaries to validate DNS response authenticity and structure
• Consider using DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to encrypted DNS servers to prevent response forgery

# Configuration example - Remove resolver dependency if not needed
# In nginx.conf, comment out or remove:
# resolver 8.8.8.8;

# Use static IP addresses for upstreams instead of hostnames:
upstream backend {
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
}

# If resolver is required, restrict to trusted internal DNS:
resolver 10.0.0.53 valid=30s ipv6=off;