Hickory DNS DNSSEC Validation Vulnerability Allowing Trust Mismanagement

A vulnerability in Hickory DNS, affecting versions 0.8.0 and prior to 0.24.3 and 0.25.0-alpha.5, mismanages trust in DNSSEC validation. The issue arises because the validation process treats entire sets of DNSKEY records as trusted once any single DNSKEY is verified. Consequently, if a zone's DNSKEY matches a trust anchor, all DNSKEYs in that zone are trusted to authenticate other records, potentially leading to incorrect validations. A similar issue exists with DS records, where an authenticated DS record for one DNSKEY can improperly extend trust to an unrelated DNSKEY in the same zone. This vulnerability impacts users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver.

Impact

Exploitation of this vulnerability can lead to incorrect DNSSEC validation, allowing for the acceptance of invalid DNS records as legitimate. This could potentially be exploited to bypass security mechanisms that rely on DNSSEC for integrity and authenticity, such as in scenarios where DNS responses are used to make security decisions or to validate the authenticity of resources.

Reproduction

The vulnerability can be reproduced by using Hickory DNS versions 0.8.0 prior to 0.24.3 and 0.25.0-alpha.5, and configuring a trust anchor that matches a DNSKEY in a zone. This can be done by setting up a DNS zone that includes a DNSKEY record matching the trust anchor, and then using the DNS client or resolver to query that zone's DNSKEY records. The validation process will incorrectly trust all DNSKEYs in the zone to authenticate other records, despite some keys being unrelated to the trust anchor. This flaw can also be demonstrated with DS records by having an authenticated DS record for one DNSKEY extend trust to an unrelated DNSKEY in the same zone.

Remediation

Users can upgrade to Hickory DNS versions 0.24.3 or 0.25.0-alpha.5, where this vulnerability has been fixed.