PowerDNS DNSdist Out-of-Bounds Read Vulnerability in Service Discovery SVCB Response Handling

An out-of-bounds read vulnerability has been identified in PowerDNS DNSdist versions through 2.0.3 and 1.9.12. This issue arises when a rogue backend sends a crafted SVCB response to a Discovery of Designated Resolvers request, specifically when the autoUpgrade option in Lua or the auto_upgrade setting in YAML is enabled. The vulnerability can lead to a denial-of-service condition, as the crafted response causes memory allocation issues that can be exploited to disrupt normal service operation.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by leading to excessive memory allocation, which can disrupt normal service operations and cause the application to become unresponsive.

Remediation

Users can upgrade to PowerDNS DNSdist versions 1.9.13 or 2.0.4, where this vulnerability has been patched. Alternatively, the Discovery of Designated Resolvers feature can be disabled.