GHSA-5fm9-h728-fwpj: 
Rust vulnerability analysis and mitigation

A moderate severity vulnerability was identified in trust-dns and trust-dns-server packages, tracked as GHSA-5fm9-h728-fwpj. The vulnerability was discovered and reported on June 1, 2023, and published to the GitHub Advisory Database on June 6, 2023. It affects trust-dns-server versions < 0.22.1 and versions >= 0.23.0-alpha.2, < 0.23.0-alpha.3. The vulnerability allows remote attackers to trigger denial-of-service attacks that consume both network and CPU resources (GitHub Advisory, RustSec Advisory).

The vulnerability stems from how the system handles DNS messages with the QR=1 bit set, which triggers FormErr responses. This behavior can be exploited to create continuous traffic loops between vulnerable servers. The technical implementation allows for two distinct attack scenarios: either creating a loop between two trust-dns instances that consumes network resources, or consuming CPU resources of a single instance (GitHub Advisory).

The vulnerability can lead to significant resource consumption in two ways: network resource depletion through continuous packet exchanges between servers, and CPU resource exhaustion where a single server can have its CPU cores locked up. Multiple spoofed packets from an attacker can escalate the resource consumption, potentially affecting multiple CPU cores (RustSec Advisory).

An attacker can exploit this vulnerability by sending DNS queries with spoofed source IP addresses. In a two-server scenario, when server A receives the spoofed query, it sends a FormErr to server B, creating a ping-pong effect that continues until the packet is dropped by the network. For single-server attacks, the same mechanism can be used to make a server reply to itself, causing CPU core lockup (GitHub Advisory).

The vulnerability has been patched in versions 0.22.1 and 0.23.0-alpha.3 of the trust-dns-server package. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory, RustSec Advisory).