CVE-2024-1931
Nlnetlabs
CVE-2024-1931 is a denial-of-service vulnerability in NLnet Labs Unbound DNS resolver versions 1.18.0 through 1.19.1. This flaw can trigger an infinite loop due to an unchecked condition in the EDE record trimming code, leading to denial of service. The SVRS score of 30 suggests a low level of exploitability despite the 'In The Wild' tag, indicating that while exploits may exist, they are not widespread or easily executed. The vulnerability occurs when Unbound attempts to include EDE information in a response while the client's buffer size is insufficient, but only when the 'ede: yes' option is enabled. This configuration is non-default, limiting the scope of potential impact. Upgrading to version 1.19.2 or later resolves this issue by preventing the infinite loop. Although the CVSS score is 7.5, the low SVRS score suggests that active exploitation is not prevalent and that mitigation efforts should be prioritized based on the specific configuration.
Description
CVE-2024-1931 is a denial-of-service vulnerability in NLnet Labs Unbound versions 1.18.0 to 1.19.1. The vulnerability arises from an unchecked condition in the code that trims the text of EDE records, leading to an infinite loop. This can only be triggered when the 'ede: yes' option is used.
Key Insights
- SVRS Score: 30, indicating a moderate risk.
- Exploit Status: Active exploits have been published.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In The Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies
- Update to Unbound version 1.19.2 or later.
- Disable the 'ede: yes' option if possible.
- Implement rate limiting to prevent excessive requests.
- Monitor logs for suspicious activity and take appropriate action.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.