CVE-2022-30699: Nlnetlabs Unbound DoS Vulnerability

CVE-2022-30699 Overview

NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. This DNS vulnerability allows attackers to keep expired delegation information cached in Unbound DNS resolvers indefinitely, potentially enabling persistent domain hijacking scenarios.

The vulnerability works by targeting an Unbound instance when cached delegation information is about to expire. A rogue nameserver delays the response until the cached delegation information expires, then Unbound overwrites the now expired entries with the delayed answer containing malicious delegation information. This process can be repeated continuously, keeping rogue delegation information ever-updating in the cache.

Critical Impact

Attackers can manipulate DNS cache to maintain control over expired or revoked domain delegations, potentially redirecting users to malicious servers indefinitely.

Affected Products

• NLnet Labs Unbound versions up to and including 1.16.1
• Fedora 35
• Fedora 36

Discovery Timeline

• 2022-08-01 - CVE-2022-30699 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-30699

Vulnerability Analysis

This vulnerability represents a novel attack vector against DNS resolver caching mechanisms. The ghost domain names attack exploits the way Unbound handles delegation information expiration and cache updates. Unlike traditional cache poisoning attacks, this technique leverages timing manipulation to maintain persistent control over cached DNS records.

The attack requires authenticated network access to query the vulnerable Unbound instance. The primary impact is on confidentiality, as attackers can redirect DNS queries to servers under their control, potentially intercepting sensitive communications or serving malicious content to users who believe they are accessing legitimate domains.

The core issue relates to CWE-613 (Insufficient Session Expiration), where the resolver fails to properly validate whether incoming delegation responses should be allowed to overwrite expired cache entries based on when the original query was initiated.

Root Cause

The root cause lies in how Unbound handles the timing relationship between DNS queries and responses for delegation information. When a query is made just before cached delegation information expires, and a malicious nameserver deliberately delays its response until after expiration, Unbound incorrectly accepts and stores the delayed response. The resolver did not track the original query start time to determine if the response should be eligible to update the cache.

From version 1.16.2 onward, Unbound stores the start time for each query and uses that timestamp to decide whether cached delegation information can be overwritten, preventing this attack vector.

Attack Vector

The attack leverages network-based access to target Unbound DNS resolvers. An attacker controlling a rogue nameserver can execute this attack by:

1. Setting up a malicious nameserver for a domain under their control
2. Waiting for the victim Unbound resolver to query for delegation information
3. Timing the attack to occur when the cached delegation is about to expire
4. Deliberately delaying the DNS response until after the cache entry expires
5. Sending the delayed response containing rogue delegation information
6. Repeating this process continuously to maintain persistent cache control

The attack does not require user interaction and can be performed remotely across the network, though it requires low-level privileges (authenticated access to make DNS queries against the target resolver).

Detection Methods for CVE-2022-30699

Indicators of Compromise

• Unusual patterns of DNS delegation queries to the same domain names near cache expiration times
• DNS responses arriving with timestamps significantly after expected response windows
• Persistent delegation cache entries for domains that should have expired or been revoked
• Anomalous DNS traffic patterns involving delayed responses from specific nameservers

Detection Strategies

• Monitor Unbound resolver logs for patterns of repeated queries to the same delegation just before TTL expiration
• Implement DNS response timing analysis to detect artificially delayed responses
• Compare cached delegation information against authoritative sources to identify discrepancies
• Deploy network-level monitoring to detect suspicious patterns in DNS query/response timing

Monitoring Recommendations

• Enable verbose logging on Unbound resolvers to capture detailed query timing information
• Implement alerting for DNS cache entries that persist beyond expected TTL boundaries
• Monitor for domains known to be expired or revoked appearing in active DNS caches
• Use DNS threat intelligence feeds to identify potentially malicious nameservers

How to Mitigate CVE-2022-30699

Immediate Actions Required

• Upgrade NLnet Labs Unbound to version 1.16.2 or later immediately
• Review DNS resolver logs for signs of ghost domain exploitation
• Audit current DNS cache contents for suspicious or unexpected delegation entries
• Consider temporarily flushing DNS caches on affected systems after patching

Patch Information

NLnet Labs has addressed this vulnerability in Unbound version 1.16.2. The fix introduces query start time tracking, which ensures that delegation responses are only accepted if they arrive within the validity window of the original query. This prevents attackers from using delayed responses to overwrite expired cache entries.

For detailed patch information, refer to the NLnet Labs Vulnerability Report. Distribution-specific patches are available through:

• Fedora Package Announcements
• Debian LTS Security Announcement
• Gentoo GLSA 2022-02

Workarounds

• Reduce DNS cache TTLs to minimize the window of opportunity for exploitation
• Implement strict access controls to limit which clients can query the Unbound resolver
• Consider deploying DNS response validation mechanisms at the network perimeter
• Monitor and block traffic from known malicious nameservers using threat intelligence feeds

# Configuration example - Reduce cache TTL and enable logging
# Add to unbound.conf
server:
    # Enable extended logging for detection
    verbosity: 2
    log-queries: yes
    log-replies: yes
    
    # Reduce cache TTL to minimize attack window (temporary workaround)
    cache-max-ttl: 3600
    
    # Restrict access to trusted clients only
    access-control: 127.0.0.0/8 allow
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse