CoreDNS Headless Service AXFR Transfer Panic Vulnerability

A vulnerability in CoreDNS versions 1.9.4 prior to 1.14.5 allows a network DNS client to trigger a panic during AXFR zone transfers. This issue arises when CoreDNS is configured to use 'k8s_external' headless-service zone transfers, and Kubernetes has a headless service endpoint without declared ports. The 'k8s_external' transferer can then send an empty batch of DNS records, which the 'transfer' plugin attempts to process, leading to a panic. In normal operation, this panic is recovered and returned as a SERVFAIL response, but it can disrupt requests and increase panic logging. If the 'debug' plugin is active, it can cause the CoreDNS process to crash.

Impact

Exploiting this vulnerability causes a panic in the CoreDNS transfer plugin, which can disrupt DNS requests and, if the 'debug' plugin is enabled, crash the CoreDNS process.

Reproduction

The vulnerability can be reproduced by configuring CoreDNS with 'k8s_external' headless-service zone transfers and ensuring that there is a headless service endpoint in Kubernetes with no declared ports. This setup will cause the 'k8s_external' transferer to emit an empty batch during AXFR transfers, which the 'transfer' plugin will attempt to process and panic.

Remediation

Users can upgrade to CoreDNS version 1.14.5, where this vulnerability has been fixed.