PowerDNS DNSdist Out-of-Bounds Read Vulnerability When Parsing DNS Packets via Lua

A vulnerability allowing out-of-bounds read has been identified in PowerDNS DNSdist versions 1.9.0 prior to 1.9.11 and 2.0.0 prior to 2.0.2. This issue arises when custom Lua code utilizes 'newDNSPacketOverlay' to parse DNS packets, potentially leading to a crash and causing a denial-of-service, or allowing access to unrelated memory which could result in information disclosure.

Impact

Exploitation of this vulnerability can cause a denial-of-service by triggering a crash, or it can lead to unauthorized access to memory, with the possibility of disclosing sensitive information.

Remediation

Users can upgrade to PowerDNS DNSdist 1.9.12 or 2.0.3, where this vulnerability has been patched. Alternatively, the 'newDNSPacketOverlay' function can be avoided in custom Lua code.