CVE-2024-24788: DNS Lookup Denial of Service Vulnerability

CVE-2024-24788 Overview

CVE-2024-24788 is a Denial of Service vulnerability affecting the Go programming language's DNS resolution functionality. A malformed DNS message received in response to a query can cause the Lookup functions within Go's net package to enter an infinite loop, leading to resource exhaustion and application hang.

Critical Impact

Applications built with Go that perform DNS lookups can be rendered unresponsive when an attacker controls or can manipulate DNS responses, causing denial of service conditions.

Affected Products

• Go programming language (net package DNS lookup functions)
• Applications built with affected Go versions
• NetApp products using affected Go versions (see NTAP-20240605-0002 and NTAP-20240614-0001)

Discovery Timeline

• 2024-05-08 - CVE-2024-24788 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24788

Vulnerability Analysis

This vulnerability falls under CWE-835 (Loop with Unreachable Exit Condition), commonly known as an Infinite Loop vulnerability. The flaw exists in Go's DNS resolution implementation within the net package, specifically affecting the Lookup family of functions used for DNS queries.

When Go applications perform DNS lookups using functions such as net.LookupHost(), net.LookupIP(), net.LookupAddr(), or similar Lookup methods, the application sends DNS queries to configured resolvers. If a malicious or compromised DNS server responds with a specially crafted malformed DNS message, the parsing logic fails to properly handle the malformed response, causing the lookup function to enter an infinite loop.

The vulnerability requires network access and depends on the attacker's ability to either control a DNS server that the target application queries, or to perform a man-in-the-middle attack to inject malformed DNS responses. This high attack complexity is reflected in the vulnerability's characteristics.

Root Cause

The root cause of CVE-2024-24788 is improper input validation and loop termination logic in Go's DNS message parsing code. When processing DNS response messages, the code fails to properly validate certain fields or message structures, leading to a condition where the parsing loop cannot reach its exit condition when encountering malformed data.

The fix implemented in Go.dev Code Change CL/578375 addresses this by adding proper bounds checking and loop termination conditions when parsing DNS response messages.

Attack Vector

The attack vector is network-based. An attacker can exploit this vulnerability through several scenarios:

1. Malicious DNS Server: If an attacker can cause the target application to query a DNS server they control, they can respond with a malformed DNS message
2. DNS Response Injection: Through network position (MITM), an attacker could intercept and replace legitimate DNS responses with malformed ones
3. Compromised Resolver: If a DNS resolver is compromised, it could serve malformed responses to applications

The attack does not require user interaction or privileges but does require the attacker to be in a position to supply DNS responses to the vulnerable application. For more technical details, see the Go Vulnerability Report GO-2024-2824.

Detection Methods for CVE-2024-24788

Indicators of Compromise

• Sudden unresponsiveness in Go-based applications performing DNS lookups
• High CPU utilization by Go applications stuck in infinite loops
• DNS resolution timeouts or failures in dependent services
• Process threads consuming 100% CPU without completing DNS operations

Detection Strategies

• Monitor Go application CPU usage for sustained high utilization patterns
• Implement application-level health checks that include DNS lookup functionality tests
• Use network monitoring to identify anomalous DNS response patterns or unusually large DNS responses
• Deploy watchdog timers around DNS operations to detect infinite loop conditions

Monitoring Recommendations

• Set up alerting for Go application process CPU thresholds exceeding normal baselines
• Monitor DNS query/response latency metrics for sudden increases indicating stalled lookups
• Implement application performance monitoring (APM) to track DNS resolution function performance
• Review DNS traffic logs for malformed or suspicious response patterns

How to Mitigate CVE-2024-24788

Immediate Actions Required

• Upgrade Go to a patched version that addresses this vulnerability
• Review and inventory all applications built with Go that perform DNS lookups
• Consider implementing DNS query timeouts at the application level as a defense-in-depth measure
• Monitor affected applications for signs of exploitation until patches are applied

Patch Information

The Go development team has addressed this vulnerability in Code Change CL/578375. Organizations should update their Go installations to the latest patched version and rebuild affected applications.

For detailed information about affected versions and remediation steps, consult the Go Vulnerability Report GO-2024-2824 and the Go Announcement on Google Groups.

NetApp customers should refer to security advisories NTAP-20240605-0002 and NTAP-20240614-0001 for product-specific guidance.

Workarounds

• Implement context-based timeouts around DNS lookup operations to prevent indefinite hangs
• Use trusted DNS resolvers and ensure DNS traffic is protected from manipulation
• Consider using external DNS resolution libraries with known-good behavior as temporary measures
• Deploy network-level protections to validate DNS response integrity where possible