Executive Summary

CoreDNS' DNS-over-QUIC (DoQ) server has a vulnerability where it fails to properly limit the number of active streams, allowing a remote attacker to cause excessive goroutine and memory growth.

By opening many QUIC streams and sending only 1 byte before stalling, an attacker can block all worker threads and create an unbounded backlog of waiting goroutines.

This happens because the DoQ server spawns a new goroutine for each accepted stream even when the worker pool is full, and these goroutines can block indefinitely in read operations without per-stream deadlines.

The issue enables unauthenticated remote denial-of-service through memory exhaustion, potentially leading to out-of-memory kills or service crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause CoreDNS servers to experience unbounded memory growth and excessive goroutine spawning, which can exhaust system resources.

As a result, the server may be terminated by the operating system due to out-of-memory conditions (OOM-kill) or crash, leading to denial of service.

Since the attack is unauthenticated and remote, any attacker can exploit this to disrupt DNS services relying on vulnerable CoreDNS versions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a remote attacker opening many QUIC streams and sending only 1 byte per stream to cause excessive goroutine and memory growth in CoreDNS versions prior to 1.14.3.

Detection can focus on monitoring unusual spikes in the number of QUIC streams or excessive memory and goroutine usage by the CoreDNS process.

Suggested commands to detect potential exploitation include:

• Use system monitoring tools like 'top' or 'htop' to observe CoreDNS memory and CPU usage.
• Use 'netstat -anp | grep :<DoQ-port>' or 'ss -anp | grep :<DoQ-port>' to monitor active QUIC connections on the DNS-over-QUIC port.
• Use 'lsof -p <coredns_pid>' to check open QUIC streams.
• Check CoreDNS logs for unusually high numbers of QUIC streams or errors related to resource exhaustion.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade CoreDNS to version 1.14.3 or later, where this vulnerability has been fixed.

No known workarounds exist to fully mitigate this issue without upgrading.

Additionally, consider monitoring and limiting the number of QUIC streams or connections at the network level to reduce exposure until the upgrade can be applied.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0