Bug 2222260 - systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes [fedora]
Summary: systemd-resolved: Unsigned name response in signed zone is not refused when D...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: systemd
Version: 39
Hardware: Unspecified
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: systemd-maint
QA Contact: Fedora Extras Quality Assurance
URL: https://github.com/systemd/systemd/is...
Whiteboard:
Depends On: CVE-2023-7008
Blocks: 2222261 2222266
TreeView+ depends on / blocked
 
Reported: 2023-07-12 13:03 UTC by Petr Menšík
Modified: 2024-01-27 02:12 UTC (History)
10 users (show)

Fixed In Version: systemd-254.8-2.fc39 systemd-253.15-2.fc38
Clone Of:
: 2222261 (view as bug list)
Environment:
Last Closed: 2024-01-24 01:29:24 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github systemd systemd issues 15158 0 None open DNSSEC doesn't prevent MITM 2023-07-28 23:31:19 UTC
Github systemd systemd issues 25676 0 None open resolved DNSSEC validation can be bypassed by MITM 2023-07-18 07:46:59 UTC

Description Petr Menšík 2023-07-12 13:03:26 UTC
Found that on upstream issue:
https://github.com/systemd/systemd/issues/25676

All needed is to fake content in signed zone, reported with unbound:

server:
  local-zone: example.org typetransparent
  local-data: "example.org. 3600 IN A 127.0.0.1"



Reproducible: Always

Steps to Reproduce:
1. Enable DNSSEC=yes
2. Run local unbound, configure fake local-data
3. Set DNS=127.0.0.1
4. resolvectl query -t example.org
Actual Results:  
[root@rawhide ~]# resolvectl query -t a example.org
example.org IN A 127.0.0.1

-- Information acquired via protocol DNS in 8.5ms.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: network
[root@rawhide ~]# resolvectl query -t aaaa example.org
example.org IN AAAA 2606:2800:220:1:248:1893:25c8:1946

-- Information acquired via protocol DNS in 10.2ms.
-- Data is authenticated: yes; Data was acquired via local or encrypted transport: no
-- Data from: network

Expected Results:  
Similar to when signature is present, -t a should be reported as invalid, only -t aaaa successful.

Marking it with high severity, because it undermines purpose of whole DNSSEC presence.

Comment 1 Fedora Release Engineering 2023-08-16 08:07:56 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle.
Changing version to 39.

Comment 2 Fedora Update System 2024-01-22 18:47:35 UTC
FEDORA-2024-c79658eedf has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2024-c79658eedf

Comment 3 Fedora Update System 2024-01-22 18:48:14 UTC
FEDORA-2024-b8312ca5b3 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2024-b8312ca5b3

Comment 4 Fedora Update System 2024-01-23 01:18:06 UTC
FEDORA-2024-b8312ca5b3 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-b8312ca5b3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-b8312ca5b3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2024-01-23 01:51:51 UTC
FEDORA-2024-c79658eedf has been pushed to the Fedora 38 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c79658eedf`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c79658eedf

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2024-01-24 01:29:24 UTC
FEDORA-2024-b8312ca5b3 has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2024-01-27 02:12:34 UTC
FEDORA-2024-c79658eedf has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.