Cloudflare has confirmed that it was affected by a critical vulnerability, CVE-2023-50387, dubbed "KeyTrap," which could allow an attacker to exhaust CPU resources on a DNS resolver, effectively creating a denial-of-service condition. The vulnerability, which affects DNSSEC, was publicly disclosed by researchers at the University of Stuttgart and the German National Research Center for Applied Cybersecurity ATHENE.
The KeyTrap vulnerability exploits a flaw in how DNSSEC-validating resolvers process DNSKEY records. An attacker can craft a malicious DNSSEC zone that, when queried, forces the resolver to perform an excessive number of cryptographic signature verifications. This intensive computational load can consume all available CPU resources, leading to a denial of service for legitimate DNS queries. The researchers demonstrated that a single DNS query to a vulnerable resolver could trigger this resource exhaustion.
Cloudflare, a major provider of DNS services, confirmed that its 1.1.1.1 public DNS resolver was susceptible to KeyTrap. The company stated that it had implemented a fix for the vulnerability on December 15, 2023, following responsible disclosure by the researchers. Cloudflare's mitigation involved changes to its DNS resolver software to limit the number of cryptographic operations performed for a single DNS query, preventing the resource exhaustion attack.
The vulnerability's impact extends beyond Cloudflare, as it affects any DNSSEC-validating resolver that does not properly handle the malicious DNSKEY record structure. This includes a wide range of DNS software implementations. The researchers indicated that the attack could be executed with a single DNS query, making it a potent tool for disrupting internet services reliant on DNSSEC.
DNSSEC, or Domain Name System Security Extensions, is a suite of specifications designed to add a layer of security to the DNS by authenticating DNS data. While DNSSEC aims to prevent spoofing and other attacks, the KeyTrap vulnerability highlights a critical weakness in its implementation across various resolvers. The vulnerability underscores the complexity of securing fundamental internet protocols and the potential for subtle flaws to have widespread impact.
The disclosure of KeyTrap has prompted a broader call for DNS operators and software vendors to update their systems and ensure they are protected against this specific attack vector. Organizations that operate their own DNSSEC-validating resolvers are advised to consult their software vendors for patches and mitigation strategies. The fix implemented by Cloudflare and other affected parties typically involves rate-limiting or otherwise restricting the processing of overly complex DNSSEC responses.
