A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack)
has been discovered in various DNS resolving software.

We are assigning CVE-2022-3204 and we are categorizing the vulnerability with a
MEDIUM severity for Unbound.

== Summary
The NRDelegation Attack can exploit resolvers by having a malicious delegation
with a considerable number of non responsive nameservers. It can trigger high
CPU usage in some resolver implementations that continually look in the cache
for resolved NS records in that delegation. This can lead to degraded
performance and eventually denial of service in orchestrated attacks.

Unbound does not suffer from high CPU usage, but resources are still needed for
resolving the malicious delegation. Unbound 1.16.3 includes fixes for better
performance when under load.

== Affected products
Unbound up to and including 1.16.2.

== Description
The NRDelegation Attack can cause a resolver to spend a lot of time/resources
resolving records under a malicious delegation point where a considerable
number of unresponsive NS records reside. It can trigger high CPU usage in some
resolver implementations that continually look in the cache for resolved NS
records in that delegation. This can lead to degraded performance and
eventually denial of service in orchestrated attacks.

The NRDelegation Attack works by having a malicious delegation with a
considerable number of non responsive nameservers. The attack starts by
querying Unbound for a record that relies on those unresponsive nameservers.
Unbound will keep trying to resolve the record until hard limits are reached.
Based on the nature of the attack and the replies, different limits could be
reached.

From version 1.16.3 on, Unbound introduces fixes for better performance when
under load, by cutting opportunistic queries for nameserver discovery and
DNSKEY prefetching and limiting the number of times a delegation point can
issue a cache lookup for missing records.

== Solution
Install Unbound version 1.16.3 or later.

== Acknowledgments
We would like to thank Yehuda Afek from Tel-Aviv University, Anat Bremler-Barr
and Shani Stajnrod from Reichman University for discovering and disclosing the
vulnerability.