CVE-2024-43167

What it actually does

NULL pointer dereference in ub_ctx_set_fwd when specific sequences of API calls (such as ub_ctx_set_fwd followed by ub_ctx_resolvconf) are invoked, resulting in a segmentation fault and process termination.

Why it matters to the business

Low-risk denial-of-service condition limited to local API misuse with minimal likelihood of impact in production deployments; disputed by the upstream developer as within expected behavior and controls.

How an attack unfolds

An attacker with the ability to invoke Unbound resolver library APIs in a controlled local context calls ub_ctx_set_fwd and related functions in a crafted order that triggers the NULL dereference, crashing the process.

How to fix it

No vendor fixes are published; consult Red Hat or NLnet Labs documentation for any configuration hardening or API usage guidance. Monitor upstream Unbound releases for potential behavioral changes.

How to confirm the fix worked

Review application source or runtime logs for NULL dereference crashes in ub_ctx_set_fwd; test API call sequences in isolated environments to confirm crash behavior is absent after any configuration or library updates.

Typical attack path

1. Obtain local access or control sufficient to load and call Unbound resolver APIs
2. Invoke ub_ctx_set_fwd followed by ub_ctx_resolvconf (or equivalent sequence) in rapid succession
3. Trigger NULL pointer dereference causing segmentation fault
4. Observe application termination resulting in denial of service

How to detect it

Search process crash logs and core dumps for segmentation faults originating from ub_ctx_set_fwd; review local application logs for repeated resolver initialization failures around the time of the reported crash.

What your security team should do

• Treat as low priority given disputed security impact and very low EPSS
• Restrict local access to resolver library APIs where feasible
• Monitor for any future upstream statements resolving the dispute