Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-7008
CVE-2023-7008:
NixOS vulnerability analysis and mitigation
Overview
A vulnerability was discovered in systemd-resolved (CVE-2023-7008) that allows the component to accept records of DNSSEC-signed domains even when they have no signature. This vulnerability was disclosed on December 23, 2023, affecting systemd-resolved component in systemd versions up to 256. The issue impacts systems where DNSSEC validation is enabled (NVD, Debian Tracker).
Technical details
The vulnerability exists in systemd-resolved's DNSSEC validation mechanism. When DNSSEC=yes is set and querying a DNSSEC-enabled domain, systemd-resolved incorrectly accepts unsigned records from DNSSEC-signed domains, failing to properly validate the authenticity of DNS responses. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD, GitHub Issue).
Impact
When exploited, this vulnerability allows man-in-the-middle attackers or compromised upstream DNS resolvers to manipulate DNS records of DNSSEC-signed domains by stripping signatures and providing arbitrary values. This undermines the security guarantees that DNSSEC is designed to provide, potentially leading to the redirection of traffic to malicious servers (GitHub Issue, Debian Tracker).
Mitigation and workarounds
The vulnerability has been fixed in multiple versions of systemd: v256, v255.2, v254.8, v253.15, v252.21, v251.20, v250.14, v249.17, and v248.13. System administrators are advised to update to the fixed versions. For systems that cannot be immediately updated, it's important to note that DNSSEC is typically disabled by default, which prevents exploitation (Debian Tracker, Red Hat Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management