Full Report
A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://www.saddns.net/. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: SAD DNS (Side-channel Attack on DNS)
## CVE Details
- **CVE ID:** CVE-2020-25705
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-200 (Information Exposure), CWE-330 (Use of Insufficiently Random Values)
## Affected Systems
- **Products:** Siemens products utilizing affected Linux kernel versions (specifically those acting as DNS resolvers or forwarders).
- **Versions:** Linux Kernel versions 3.18 through 5.10.
- **Configurations:** Systems configured to allow incoming ICMP "Destination Unreachable" (Type 3, Code 3) messages. The vulnerability specifically targets the DNS resolver functionality.
## Vulnerability Description
SAD DNS is a side-channel attack that exploits a flaw in the Linux kernel's ICMP rate-limiting mechanism. By sending UDP packets to closed ports and monitoring the ICMP "Port Unreachable" responses, an attacker can deduce if a specific source port is open or closed.
This allows an attacker to bypass Source Port Randomization (a key defense against DNS cache poisoning). By identifying the correct source port, the attacker significantly reduces the entropy required to successfully inject a forged DNS response into a resolver's cache.
## Exploitation
- **Status:** PoC available / Publicly disclosed.
- **Complexity:** High (Requires precise timing and a large volume of packets).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Low (Information exposure regarding port status).
- **Integrity:** High (Allows for DNS Cache Poisoning/Spoofing, leading to traffic redirection).
- **Availability:** None.
## Remediation
### Patches
- **Siemens Products:** Users should refer to specific Siemens Security Advisories (e.g., SSA-913816) for the latest firmware updates.
- **Linux Kernel:** Update to kernel versions that include the fix (e.g., 5.10+, or backported patches for older LTS kernels) which introduces noise into the ICMP rate-limiting counter.
### Workarounds
- **ICMP Rate Limiting:** Increase the ICMP rate limit to a very high value to make the side-channel scan impractical.
- **Disable ICMP:** Block outgoing ICMP "Port Unreachable" messages at the firewall level.
- **DNS Configuration:** Use DNS over HTTPS (DoH) or DNS over TLS (DoT) to encrypt queries and prevent spoofing.
## Detection
- **Indicators of Compromise:** Unusual spikes in ICMP Type 3 Code 3 traffic originating from the DNS resolver.
- **Detection Methods:**
- Network Intrusion Detection Systems (NIDS) can be configured to alert on rapid UDP scans targeting closed ports followed by DNS response bursts.
- Monitoring for unexpected changes in DNS resolution patterns.
## References
- **Siemens Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-913816[.]pdf
- **Research Site:** hxxps[://]www[.]saddns[.]net/
- **NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2020-25705