Listen to this Post
A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8s_external transferer can emit an empty batch of resource records, and the shared transfer plugin indexes records without checking that the batch is non-empty. In normal CoreDNS mode the panic is recovered and returned as a failure, but repeated triggering can disrupt requests and amplify panic logging; if debugging options disable recovery, the same execution path can crash the entire CoreDNS process.
DailyCVE Form:
Platform: CoreDNS
Version: All Versions
Vulnerability : Null Pointer
Severity: Medium
date: 2024-10-15
Prediction: 2024-10-20
What Undercode Say:
Bash Commands and Codes
for records := range pchan {
if len(records) == 0 {
continue
}
if x, ok := records[bash].(dns.SOA); ok && soa == nil {
soa = x
}
}
Exploit: (Educational Purposes!)
func (auditEmptyBatchTransferer) Transfer(zone string, serial uint32) (<-chan []dns.RR, error) {
ch := make(chan []dns.RR, 2)
ch <- []dns.RR{}
close(ch)
return ch, nil
}
Protection: from this CVE
Upgrade CoreDNS to the latest patched release, skip or reject empty records batches before indexing records, and ensure transferers only send non-empty batches for headless services.
Impact
Allows authenticated or permitted clients to cause denial of service via panic conditions, resulting in request failure or process termination when debugging options are enabled.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
