Database/Kernel, userspace & hypervisor
systemd-resolved: accepts unsigned records for DNSSEC-signed domains
Impact
systemd-resolved can accept records for a DNSSEC-signed domain even when the response carries no signature, so the integrity guarantee operators think they have from DNSSEC is not there. Anyone able to answer or tamper with DNS for a node - the upstream resolver, or a machine-in-the-middle on the path - can steer name resolution. On a fleet that resolves container registries, package mirrors, object storage endpoints, license servers and control-plane addresses by name, that means pulled images and fetched artifacts can be redirected to an attacker-chosen host. Integrity only; no confidentiality or availability impact per the record.
Who can reach it
Network position between the node and its DNS resolver, or control of the upstream resolver itself. No authentication to the host needed; the attacker never touches the node directly.
What to do
Update systemd on each node and restart systemd-resolved (vendor errata RHSA-2024:2463 and RHSA-2024:3203 for RHEL 8/9; the upstream systemd fix ships in distro packages). A daemon restart is enough - no reboot - though resolved restarts briefly flush the cache. Where resolved is not the stub resolver on the node, exposure does not apply.
References
Related entries
- OpenSSL: TLSv1.3 server session cache grows without bound, exhausting memoryCVE-2024-2511 · OpenSSL (TLSv1.3 server session cache with SSL_OP_NO_TICKET)Medium
- OpenSSH (sshd): Pre-auth memory/CPU amplification - denial of service against sshdCVE-2025-26466 · OpenSSH (sshd)Medium
- Linux kernel (drivers/pci/endpoint/functions): When BAR allocation fails, the endpoint test function frees the backingCVE-2025-38069 · Linux kernel (drivers/pci/endpoint/functions)Medium
- OpenSSL: timing side-channel in SM2 signing on 64-bit ARM may leak the private keyCVE-2025-9231 · OpenSSL SM2 signature implementation (64-bit ARM)Medium
- OpenSSL: out-of-bounds read crashes the HTTP client when no_proxy is set and the URL host is IPv6CVE-2025-9232 · OpenSSL HTTP client API (no_proxy handling of IPv6 authority)Medium
- Linux kernel (drivers/iommu): An unaligned DMA mapping with no aligned middle section calls into the mapper with lengthCVE-2026-53164 · Linux kernel (drivers/iommu)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.