As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow bug(see the link here).
The consequences of this seem to be quiet horrific and it will take time to even have an overview on the size of the list of vulnerable hardware and software which uses this library.
While the extension of the damage and the fixes to follow will hopefully come sooner rather than later, there are some mitigation's which may prevent the attack advised by Google researchers:
Google has found some mitigations that may help prevent exploitation if you are not able to immediately patch your instance of glibc. The vulnerability relies on an oversized (2048+ bytes) UDP or TCP response, which is followed by another response that will overwrite the stack. Our suggested mitigation is to limit the response (i.e., via DNSMasq or similar programs) sizes accepted by the DNS resolver locally as well as to ensure that DNS queries are sent only to DNS servers which limit the response size for UDP responses with the truncation bit set.*
And Glibc maintainers provide the following mitigations:
Mitigating factors for UDP include:
A firewall that drops UDP DNS packets > 512 bytes.
A local resolver (that drops non-compliant responses).
Avoid dual A and AAAA queries (avoids buffer management error) e.g. Do not use AF_UNSPEC.
No use of
options edns0in /etc/resolv.conf since EDNS0 allows responses larger than 512 bytes and can lead to valid DNS responses that overflow.
No use of
RES_USE_DNSSECsince they can both lead to valid large EDNS0-based DNS responses that can overflow.
Mitigating factors for TCP include:
- Limit all replies to 1024 bytes.
At the moment I am trying to find a way to limit the size of responses via iptables and the use of the limit module. But so far I have only found ways to use the rate-limits which are not applicable here. Any ideas how this could be translated into an iptables rule(s)?
I am also currently looking into how to have a dns resolver to drop non-compliant responses, so any thoughts/ideas are most welcome.