CVE-2023-50387

2024-02-1300:00:00

ubuntu.com

dnssec

denial of service

cpu consumption

rfc 4033

rfc 4034

rfc 4035

rfc 6840

keytrap

bind9 libs

isc-dhcp

remote attackers

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.05 Low

EPSS

Percentile

92.9%

JSON

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840,
and related RFCs) allow remote attackers to cause a denial of service (CPU
consumption) via one or more DNSSEC responses, aka the “KeyTrap” issue. One
of the concerns is that, when there is a zone with many DNSKEY and RRSIG
records, the protocol specification implies that an algorithm must evaluate
all combinations of DNSKEY and RRSIG records.

Notes

Author	Note
alexmurray	As of isc-dhcp-4.4.3-1, isc-dhcp vendors bind9 libs
mdeslaur	This is unlikely to affect isc-dhcp’s use of bind9-libs and the vendored bind9 libs, marking as negligible

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchbind9< 1:9.11.3+dfsg-1ubuntu1.19+esm3UNKNOWN
ubuntu20.04noarchbind9< 1:9.16.48-0ubuntu0.20.04.1UNKNOWN
ubuntu22.04noarchbind9< 1:9.18.18-0ubuntu0.22.04.2UNKNOWN
ubuntu23.10noarchbind9< 1:9.18.18-0ubuntu2.1UNKNOWN
ubuntu24.04noarchbind9< 1:9.18.24-0ubuntu1UNKNOWN
ubuntu14.04noarchbind9< 1:9.9.5.dfsg-3ubuntu0.19+esm12UNKNOWN
ubuntu16.04noarchbind9< 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8UNKNOWN
ubuntu20.04noarchbind9-libs< anyUNKNOWN
ubuntu22.04noarchbind9-libs< anyUNKNOWN
ubuntu18.04noarchdnsmasq< 2.90-0ubuntu0.18.04.1+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	bind9	< 1:9.11.3+dfsg-1ubuntu1.19+esm3	UNKNOWN
ubuntu	20.04	noarch	bind9	< 1:9.16.48-0ubuntu0.20.04.1	UNKNOWN
ubuntu	22.04	noarch	bind9	< 1:9.18.18-0ubuntu0.22.04.2	UNKNOWN
ubuntu	23.10	noarch	bind9	< 1:9.18.18-0ubuntu2.1	UNKNOWN
ubuntu	24.04	noarch	bind9	< 1:9.18.24-0ubuntu1	UNKNOWN
ubuntu	14.04	noarch	bind9	< 1:9.9.5.dfsg-3ubuntu0.19+esm12	UNKNOWN
ubuntu	16.04	noarch	bind9	< 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8	UNKNOWN
ubuntu	20.04	noarch	bind9-libs	< any	UNKNOWN
ubuntu	22.04	noarch	bind9-libs	< any	UNKNOWN
ubuntu	18.04	noarch	dnsmasq	< 2.90-0ubuntu0.18.04.1+esm1	UNKNOWN