Bug 1954799 (CVE-2019-25040)

Summary:	CVE-2019-25040 unbound: infinite loop via a compressed name in dname_pkt_copy
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aegorenk, akhaitovich, paul.wouters, pemensik, pj.pandit
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	unbound 1.9.6	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in unbound. An infinite loop in dname_pkt_copy function could be triggered by a remote attacker. The highest threat from this vulnerability is to service availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:39:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1859933, 1968662, 1968663, 1968664
Bug Blocks:	1954811

Description Guilherme de Almeida Suckevicz 2021-04-28 19:09:09 UTC

Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy.

Reference:
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/

Comment 1 Riccardo Schirone 2021-05-06 12:57:52 UTC

Upstream patch:
https://github.com/NLnetLabs/unbound/commit/2d444a5037acff6024630b88092d9188f2f5d8fe

Comment 3 Riccardo Schirone 2021-05-06 14:55:30 UTC

Statement:

There is no available reproducer or proof of concept for this issue, nor it was ever proven the infinite loop can be triggered in practice. Indeed in the original report this issue was considered one that might not be triggered and for this reason its Impact is Moderate.

Comment 5 errata-xmlrpc 2021-05-18 15:37:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1853 https://access.redhat.com/errata/RHSA-2021:1853

Comment 6 Product Security DevOps Team 2021-05-18 20:39:15 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-25040

Comment 8 errata-xmlrpc 2022-02-22 15:14:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:0632 https://access.redhat.com/errata/RHSA-2022:0632