PowerDNS DNSdist Out-of-Bounds Read Vulnerability via Lua Packet Cache Inspection

A vulnerability in PowerDNS DNSdist versions through 2.0.3 and 1.9.12 allows for an out-of-bounds read. This issue arises when custom Lua code invokes the functions getDomainListByAddress() or getAddressListByDomain() on a packet cache that contains a crafted response. The vulnerability can lead to a denial-of-service condition by causing excessive memory allocation.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by triggering an out-of-bounds read, which can be manipulated to disrupt normal service operations.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.13 or 2.0.4, where this vulnerability has been patched. Alternatively, avoid using the Lua functions getDomainListByAddress() or getAddressListByDomain() on packet caches.