CVE-2024-1488: Unbound DNS Privilege Escalation Flaw

CVE-2024-1488 Overview

CVE-2024-1488 is an insecure permissions vulnerability in the Unbound recursive DNS resolver as packaged by Fedora and Red Hat. The flaw stems from incorrect default permissions on the unbound-control interface, which listens on localhost TCP port 8953. Any local process outside the unbound group can connect to this port and modify the runtime configuration of unbound.service. An unprivileged local attacker can alter forwarders to redirect or observe DNS queries, or disrupt name resolution entirely. The weakness is tracked under [CWE-276: Incorrect Default Permissions].

Critical Impact
A local, unprivileged attacker can reconfigure the Unbound resolver to monitor all forwarded DNS queries or break name resolution for the entire host.

Affected Products

Fedora Project Unbound
Red Hat Enterprise Linux 8 and 9 (including EUS, AUS, and TUS streams)
Red Hat CodeReady Linux Builder (x86_64, aarch64, ppc64le, s390x)

Discovery Timeline

2024-02-15 - CVE-2024-1488 published to NVD
2025-01-30 - Last updated in NVD database

Technical Details for CVE-2024-1488

Vulnerability Analysis

Unbound exposes a remote-control interface, unbound-control, used to query statistics and modify runtime configuration of the resolver daemon. In the affected Fedora and Red Hat packages, this control channel binds to 127.0.0.1:8953 with permissions that do not restrict access to the unbound group or root. As a result, any local user or process can issue control commands to the running resolver.

The control channel accepts commands such as forward_add, forward_remove, flush, flush_zone, and reload. Attackers can use these to inject attacker-controlled forwarders, causing the resolver to send queries through a server they observe. They can also flush caches or disable resolution to deny service. Because Unbound is often the default system resolver, this affects every application on the host that relies on DNS.

Root Cause

The root cause is incorrect default permissions on the control socket and its associated TLS key material. The distribution-shipped configuration enabled control-enable: yes on localhost without enforcing group ownership of the certificate, key files, or socket. Local actors therefore inherit administrative access to a service intended to be restricted to the unbound user.

Attack Vector

Exploitation requires local code execution as any unprivileged user on the host running the vulnerable Unbound service. The attacker connects to 127.0.0.1:8953 using unbound-control or a compatible TLS client and issues configuration commands. No additional privileges or user interaction are required. The vulnerability cannot be triggered remotely across the network, but it provides a path for sandboxed or low-privilege processes to influence DNS resolution for the entire system. Refer to the Red Hat CVE-2024-1488 Details for vendor analysis.

Detection Methods for CVE-2024-1488

Indicators of Compromise

Unexpected entries in Unbound logs showing forward_add, forward_remove, or flush commands issued outside of administrative maintenance windows.
New or modified forwarder destinations in the running configuration that do not match the on-disk unbound.conf.
DNS traffic from the host destined to unfamiliar upstream resolvers or non-corporate IP addresses.

Detection Strategies

Audit file permissions on /etc/unbound/unbound_control.key, /etc/unbound/unbound_control.pem, and related certificates to confirm they are owned by the unbound group with restrictive modes.
Monitor processes invoking unbound-control and correlate the invoking UID against authorized administrators.
Use ss -ltnp or netstat to verify which users have established connections to TCP port 8953 on localhost.

Monitoring Recommendations

Forward Unbound daemon logs to a centralized logging or SIEM platform and alert on control-channel command activity.
Baseline outbound DNS destinations from each host and alert when a resolver begins forwarding to a new upstream.
Track configuration drift between the on-disk Unbound configuration and the runtime configuration returned by unbound-control list_forwards.

How to Mitigate CVE-2024-1488

Immediate Actions Required

Apply the relevant Red Hat or Fedora package updates that correct permissions on the Unbound control interface and key material.
Restrict access to TCP port 8953 on the loopback interface using host firewall rules until patches are applied.
Review the running configuration with unbound-control list_forwards and unbound-control status to confirm no unauthorized forwarders are active.

Patch Information

Red Hat has released fixed packages through multiple advisories, including RHSA-2024:1750, RHSA-2024:1751, RHSA-2024:1780, RHSA-2024:1801, RHSA-2024:1802, RHSA-2024:1804, RHSA-2024:2587, RHSA-2024:2696, and RHSA-2025:0837. Additional context is available in the Red Hat Bugzilla Report #2264183.

Workarounds

Disable the remote-control channel by setting control-enable: no in unbound.conf if unbound-control is not required.
Manually correct permissions on /etc/unbound/unbound_control.key and related files so only the unbound user and group can read them.
Block local non-administrative access to 127.0.0.1:8953 using iptables or nftables rules that filter by UID.

bash

# Configuration example: disable the remote-control interface in unbound.conf
remote-control:
    control-enable: no
    control-interface: 127.0.0.1
    control-port: 8953
    server-key-file: "/etc/unbound/unbound_server.key"
    server-cert-file: "/etc/unbound/unbound_server.pem"
    control-key-file: "/etc/unbound/unbound_control.key"
    control-cert-file: "/etc/unbound/unbound_control.pem"

# Restrict the control key files to the unbound user/group
chown root:unbound /etc/unbound/unbound_control.key /etc/unbound/unbound_control.pem
chmod 0640 /etc/unbound/unbound_control.key /etc/unbound/unbound_control.pem

# Restart the service to apply changes
systemctl restart unbound.service