DNS by itself is not secure. DNS Security Extensions (DNSSEC) strengthens authentication in DNS using digital signatures based on public key cryptography. With DNSSEC, it's not DNS queries and responses themselves that are cryptographically signed, but rather DNS data itself is signed by the owner of the data. Turning on DNSSEC validation in recursive resolvers involves changing just a few lines in the resolver's configuration file. From that point forward, when a user asks the resolver for DNS information that comes from zones that are signed, and that data has been tampered with, the user will purposely get no data back. DNSSEC protects the user from getting bad data from a signed zone by detecting the attack and preventing the user from receiving the tampered data. NSEC and NSEC3 are the mechanisms within DNSSEC used to provide proof of non-existence of names. This is achieved by a DNSSEC-signed assurance that between two signed names, no other names exist.

Both CVE-2023-50387 and CVE-2023-50868 target design flaws in the DNSSEC protocol. To initiate the attacks an adversary causes the victim resolver to look up a record in its malicious domain. The attacker’s nameserver responds to the DNS queries with malicious record sets (RRsets).

• For CVE-2023-50387 these malicious RRsets have been crafted to require a high number of validations resulting in high CPU usage on the victim resolver. Different variants of the KeyTrap resource exhaustion attack exist: KeySigTrap, SigJam, LockCram, and HashTrap.
• In case of CVE-2023-50868 the responses use multiple NSEC3 RRsets triggering a high number of NSEC3 hash iterations. This results in high CPU usage on the victim resolver.

By flooding a victim DNSSEC-validating resolver with these DNS queries, an attacker can lead to a full Denial of Service of the targeted resolver while the attack is running. The actual impact of an unresponsive DNS server depends on the victims DNS architecture.

Both vulnerabilities do not impact servers where DNSSEC-validation is disabled. Non-recursive DNS servers are also not affected by these vulnerabilities.

Both vulnerabilities were identified by security researchers. Based on vendor bulletins on these vulnerabilities no exploitation in the wild has been observed.