CVE-2022-30698: 
NixOS vulnerability analysis and mitigation

Unbound prior to version 1.16.2 was discovered to be vulnerable to a novel type of 'ghost domain names' attack that targets child-centric DNS resolvers. The vulnerability, identified as CVE-2022-30698, was discovered by Xiang Li from the Network and Information Security Lab of Tsinghua University (NLNet Labs).

The vulnerability works by targeting an Unbound instance where the attacker queries for a subdomain of a malicious domain name. The malicious nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a malicious domain name resolvable long after revocation, effectively bypassing the take down action from the parent zone operator (NLNet Labs).

The vulnerability allows malicious users to trigger continued resolvability of malicious domain names, even after their revocation from the parent zone. This means that malicious domains can remain accessible even after they have been officially revoked, potentially extending the lifetime of malicious infrastructure (NLNet Labs).

The vulnerability was fixed in Unbound version 1.16.2. The fix implements a check for the validity of parent delegation records before using cached delegation information. Users are advised to upgrade to Unbound version 1.16.2 or later to mitigate this vulnerability (NLNet Labs, Fedora Update).