CVE-2022-27227: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-27227 affects PowerDNS Authoritative Server versions before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1, as well as PowerDNS Recursor versions before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1. The vulnerability was discovered on March 25, 2022, and involves insufficient validation of an IXFR end condition that causes incomplete zone transfers to be handled as successful transfers (PowerDNS Advisory).

The vulnerability occurs when IXFR (Incremental Zone Transfer) falls back to a full zone transfer. During this process, an attacker in a man-in-the-middle position can cause the transfer to be prematurely interrupted, which is then incorrectly interpreted as a complete transfer. This results in an incomplete zone being processed. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The impact varies depending on the affected component. For the Authoritative Server, this issue only affects secondary zones where IXFR transfers are enabled and the network path to the primary server is not trusted. For the Recursor, the vulnerability affects setups retrieving RPZ (Response Policy Zone) zones from a remote server if the network path is not trusted. An incomplete RPZ transfer results in missing policy entries, potentially causing some DNS names and IP addresses to not be properly intercepted (PowerDNS Advisory).

The recommended solution is to upgrade to the patched versions: PowerDNS Authoritative Server 4.4.3, 4.5.4, or 4.6.1, and PowerDNS Recursor 4.4.8, 4.5.8, or 4.6.1. For the Authoritative Server, an alternative mitigation is to not use IXFR transfers, as they are not enabled by default (PowerDNS Advisory).

The vulnerability was reported and initially analyzed by Nicolas Dehaine and Dmitry Shabanov from ThreatSTOP. Following the disclosure, various Linux distributions including Fedora and Ubuntu released security updates to address the vulnerability (Fedora Update).