CVE-2020-12663: 
NixOS vulnerability analysis and mitigation

CVE-2020-12663 affects Unbound DNS resolver versions before 1.10.1. The vulnerability was discovered and disclosed on May 19, 2020, through fuzzing of the Unbound code. This security issue involves an infinite loop vulnerability that can be triggered via malformed DNS answers received from upstream servers (Vendor Advisory).

The vulnerability stems from issues in the parser of received answers where malformed DNS responses from upstream servers can cause Unbound to enter an infinite loop. When compiled with --enable-debug, it can also trigger an assertion, resulting in a crash. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it is network accessible, requires low complexity to exploit, and primarily impacts availability (NVD).

When exploited, this vulnerability can cause the Unbound DNS resolver to become unresponsive, resulting in a denial of service condition. The impact is particularly severe as it affects the availability of DNS resolution services, which are critical for network operations (FreeBSD Advisory).

The vulnerability can be exploited remotely by sending malformed DNS answers from upstream servers. No special privileges or user interaction is required to exploit this vulnerability. The attack vector is network-accessible, making it relatively straightforward to exploit (Ubuntu Notice).

The primary mitigation is to upgrade to Unbound version 1.10.1 or later which contains the fix for this vulnerability. For those unable to upgrade immediately, a patch is available that can be applied manually using the command 'patch -p1 < patch_cve_2020-12662_2020-12663.diff' followed by 'make install' (Vendor Advisory).