Reporter: Qifan Zhang, Palo Alto Networks
Summary
hickory_proto::rr::Name's Hash implementation only incorporates the contents of labels, not the length of labels, so it is trivial to find collisions by moving dots around. hickory_net::dnssec then uses that hash in struct ValidationCacheKey(u64) with #[derive(Eq, PartialEq)], so equal hashes are treated as a cache hit. An attacker who controls an unsigned (Insecure) delegation for a domain name that differs only in the position of dots from a target name in a signed zone can prime the validation cache with a benign Proof::Insecure verdict, then forge an answer for the target name. The resolver re-uses the colliding cache entry, skips verify_default_rrset() entirely, and returns the forged RDATA as NOERROR/AD=0 instead of returning SERVFAIL.
It is also possible to use the differences between the Hash and PartialEq implementations of Name to mount a HashDoS attack.
qifan-sailboat Reporter
Reporter: Qifan Zhang, Palo Alto Networks
Summary
hickory_proto::rr::Name'sHashimplementation only incorporates the contents of labels, not the length of labels, so it is trivial to find collisions by moving dots around.hickory_net::dnssecthen uses that hash instruct ValidationCacheKey(u64)with#[derive(Eq, PartialEq)], so equal hashes are treated as a cache hit. An attacker who controls an unsigned (Insecure) delegation for a domain name that differs only in the position of dots from a target name in a signed zone can prime the validation cache with a benignProof::Insecureverdict, then forge an answer for the target name. The resolver re-uses the colliding cache entry, skipsverify_default_rrset()entirely, and returns the forged RDATA asNOERROR/AD=0 instead of returningSERVFAIL.It is also possible to use the differences between the
HashandPartialEqimplementations ofNameto mount a HashDoS attack.