CVE-2022-3204

一、漏洞信息
 漏洞编号：[CVE-2022-3204](https://nvd.nist.gov/vuln/detail/CVE-2022-3204)
 漏洞归属组件：[unbound](https://gitee.com/src-openeuler/unbound)
 漏洞归属的版本：1.10.1,1.11.0,1.13.2
 CVSS V2.0分值：
  BaseScore：7.5 High
  Vector：CVSS：2.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  A vulnerability named  Non-Responsive Delegation Attack  (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.
 漏洞公开时间：2022-09-26 22:15:00
 漏洞创建时间：2022-09-22 07:55:16
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-3204
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt |  |
| nvd | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B/ |  |
| nvd | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY/ |  |
| nvd | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL/ |  |
| nvd | https://security.gentoo.org/glsa/202212-02 |  |
| redhat | https://access.redhat.com/security/cve/CVE-2022-3204 |  |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2128947 | https://bugzilla.suse.com/show_bug.cgi?id=1203643 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3204 | https://bugzilla.suse.com/show_bug.cgi?id=1203643 |
| redhat_bugzilla | https://nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt | https://bugzilla.redhat.com/show_bug.cgi?id=2128947 |
| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.16.3 | https://bugzilla.redhat.com/show_bug.cgi?id=2128947 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3204 | https://ubuntu.com/security/CVE-2022-3204 |
| ubuntu | https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt | https://ubuntu.com/security/CVE-2022-3204 |
| ubuntu | https://ubuntu.com/security/notices/USN-5732-1 | https://ubuntu.com/security/CVE-2022-3204 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-3204 | https://ubuntu.com/security/CVE-2022-3204 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-3204 | https://ubuntu.com/security/CVE-2022-3204 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-3204 | https://ubuntu.com/security/CVE-2022-3204 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2022-3204 |
| gentoo |  | https://security.gentoo.org/glsa/202212-02 |
| cve_search |  | https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY/ |
| cve_search |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL/ |
| cve_search |  | https://security.gentoo.org/glsa/202212-02 |
| mageia |  | http://advisories.mageia.org/MGASA-2022-0361.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2257.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2264.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2284.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2285.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2286.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2287.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2288.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2289.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2304.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2343.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2344.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2345.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2816.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2817.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-2819.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| amazon_linux | https://alas.aws.amazon.com/cve/html/CVE-2022-3037.html | https://alas.aws.amazon.com/ALAS-2022-1639.html |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2128947 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3204 |  |
| redhat_bugzilla | https://nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt |  |
| redhat_bugzilla | https://github.com/NLnetLabs/unbound/releases/tag/release-1.16.3 |  |
| redhat_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2128947 |  |
| debian | https://security-tracker.debian.org/tracker/CVE-2022-3204 |  |
| nvd | https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt |  |
| nvd | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B/ |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
        unbound存在NRDelegation攻击(非响应性委托攻击)漏洞CVE-2022-3204，NRDelegation攻击可以通过具有相当数量的无响应的名字服务器的恶意授权来利用解析器。它可以在一些解析器实现中引发高CPU使用率，这些解析器不断地在缓存中寻找该委托中已解决的NS记录。这可能导致性能下降，并最终在精心策划的攻击中导致拒绝服务。从1.16.3版本开始，Unbound引入了一些修复措施以提高负载性能，通过削减名称服务器发现和DNSKEY预取的机会查询，以及限制委派点为缺失记录发出缓存查询的次数。   
 openEuler评分：
  7.5
 Vector：CVSS：2.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(1.11.0):受影响
2.openEuler-20.03-LTS-SP3(1.11.0):受影响
3.openEuler-22.03-LTS(1.13.2):受影响
4.openEuler-22.09(1.13.2):受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(1.11.0):否
2.openEuler-20.03-LTS-SP3(1.11.0):否
3.openEuler-22.03-LTS(1.13.2):否
4.openEuler-22.09(1.13.2):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2022-1972

src-openEuler/unbound

内容风险标识

评论 (9)

src-openEuler/unbound .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-3204

评论 (9)

搜索帮助

src-openEuler/unbound