CVE-2022-30698 Novel "ghost domain names" attack by introducing subdomain delegations
Attackers can keep rogue domains resolvable by exploiting delegation cache updates, bypassing domain revocation mechanisms in Unbound DNS resolver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30698?
CVE-2022-30698 is a medium-severity vulnerability in Fedoraproject Fedora, published on 1 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.
Weakness: CWE-613
Which versions are affected by CVE-2022-30698?
It affects 2 products.
Linux distribution packages (1)
unbound openSUSE:Tumbleweed | All versions | 1.16.2-1.1 |
Products include Fedoraproject Fedora, Nlnetlabs Unbound.
How do I fix CVE-2022-30698?
Upgrade to a fixed version.
Is CVE-2022-30698 being exploited?
There is no known exploitation of CVE-2022-30698 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2022-30698, AZL-10452, DEBIAN-CVE-2022-30698, GHSA-297v-qp46-84h5, UBUNTU-CVE-2022-30698, openSUSE-SU-2024:12235-1.