CVE-2024-8418: Containers Aardvark-dns DoS Vulnerability

CVE-2024-8418 Overview

CVE-2024-8418 is a denial of service vulnerability in Aardvark-dns, the authoritative DNS server used by the Podman container engine. The flaw stems from serial processing of TCP DNS queries, allowing an attacker to hold a TCP connection open indefinitely and block all subsequent DNS resolution.

The vulnerability affects Aardvark-dns versions 1.12.0 and 1.12.1 and is tracked under [CWE-400] Uncontrolled Resource Consumption. Exploitation requires no authentication and can be triggered remotely over the network.

Critical Impact
An unauthenticated remote attacker can render container DNS services unresponsive by opening a single long-lived TCP connection, causing legitimate DNS queries to time out and disrupting container networking.

Affected Products

Aardvark-dns 1.12.0
Aardvark-dns 1.12.1
Red Hat distributions shipping the affected Aardvark-dns versions (see RHSA-2025:7094)

Discovery Timeline

2024-09-04 - CVE-2024-8418 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8418

Vulnerability Analysis

Aardvark-dns provides DNS resolution for containers in Podman networks. The server accepts both UDP and TCP DNS queries. The TCP query handler processes connections serially rather than concurrently. A single TCP client that keeps its socket open prevents the server from accepting or answering any other TCP DNS query.

Because the handler does not enforce timeouts or limit concurrent connection handling, the server becomes unresponsive for the duration of the held connection. Legitimate clients see DNS queries time out, which cascades into broken container name resolution and service-to-service communication failures.

The issue is classified under [CWE-400] Uncontrolled Resource Consumption. The EPSS probability for this CVE is 0.759%.

Root Cause

The root cause is a design flaw in the TCP query loop in Aardvark-dns. The server processes TCP connections one at a time and does not apply read or idle timeouts to in-progress connections. A client that completes the TCP handshake but delays sending the DNS query or does not close the socket holds the worker indefinitely. See the upstream discussion in GitHub Issue #500 and the fix proposed in Pull Request #503.

Attack Vector

An attacker with network reachability to the Aardvark-dns listener opens a TCP connection on the DNS port and keeps it open. No authentication, credentials, or user interaction are required. While the connection remains open, the server cannot service other TCP DNS queries, producing a denial of service for any container or workload depending on that resolver.

No verified public exploit code is available. The vulnerability mechanism is described in the Red Hat CVE entry and the Red Hat Bug Report #2309683.

Detection Methods for CVE-2024-8418

Indicators of Compromise

Long-lived TCP connections to the Aardvark-dns listener (default port 53/tcp) from a single source that never complete a DNS exchange.
Spikes in DNS query timeouts reported by containers or workloads that depend on Podman networks.
Aardvark-dns process logs showing stalled or unanswered TCP queries while UDP queries continue to process.

Detection Strategies

Monitor TCP session duration to the container DNS resolver and alert on connections exceeding expected DNS exchange durations.
Correlate container service failures with DNS resolution errors to surface availability impact early.
Inspect aardvark-dns process state and connection counts on container hosts running Podman.

Monitoring Recommendations

Collect host and container telemetry, including process and network flow data, into a centralized analytics platform for correlation.
Track DNS query latency and timeout rates per container network as a service-level indicator.
Alert when a single remote source maintains multiple concurrent TCP connections to the container DNS port.

How to Mitigate CVE-2024-8418

Immediate Actions Required

Upgrade Aardvark-dns to a patched release that processes TCP queries concurrently and enforces connection timeouts.
Apply the Red Hat security update referenced in RHSA-2025:7094 on affected Red Hat systems.
Restrict network reachability to the Aardvark-dns listener so only trusted container workloads can connect.

Patch Information

Red Hat has shipped fixed packages via RHSA-2025:7094. Upstream code changes are tracked in the Aardvark-dns repository through Pull Request #503. Validate that the installed aardvark-dns binary is newer than versions 1.12.0 and 1.12.1.

Workarounds

Use host firewall rules to limit inbound TCP connections on port 53 to the container bridge interface only.
Reduce the impact window by restarting the aardvark-dns process if hung TCP sessions are detected.
Where feasible, prefer UDP-only DNS resolution paths until the patch is applied, accepting the protocol limits this imposes.

bash

# Verify installed Aardvark-dns version and apply the vendor update
aardvark-dns --version
sudo dnf update aardvark-dns
sudo systemctl restart podman