Описание
Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.
A flaw was found in aardvark-dns where a specially crafted TCP DNS query followed by a connection reset can trigger an infinite error loop, leading to 100% CPU usage and a denial of service. As aardvark-dns is only accessible via internal Podman networks, this issue can be exploited by a local container with network access.
Отчет
This vulnerability is evaluated as having a Moderate severity because the affected service is only exposed locally within user-defined Podman container networks, preventing untrusted remote network exploitation. An attacker must already control a container running on the internal network to deliver the malformed TCP traffic required to hang the process. While successful exploitation results in complete CPU exhaustion and halts container name resolution, the blast radius is confined to host resources and container network DNS availability without compromising data integrity or confidentiality.
Меры по смягчению последствий
As a mitigation, avoid using aardvark-dns when container name resolution is not required by creating Podman networks with DNS disabled (e.g., podman network create --disable-dns). This prevents the vulnerable component from being used.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | container-tools:rhel8/aardvark-dns | Affected | ||
| Red Hat Enterprise Linux 8 | container-tools:rhel8/containers-common | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected | ||
| Red Hat Enterprise Linux 10 | aardvark-dns | Fixed | RHSA-2026:36782 | 08.07.2026 |
| Red Hat Enterprise Linux 9 | aardvark-dns | Fixed | RHSA-2026:36318 | 07.07.2026 |
| Red Hat Hardened Images | aardvark-dns-main-2.1.0-1.hum1 | Fixed | RHSA-2026:56999 | 19.08.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.
Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1.
Aardvark-dns is an authoritative dns server for A/AAAA container recor ...
EPSS
6.5 Medium
CVSS3