CVE-2022-27227
📋 TL;DR
This vulnerability in PowerDNS Authoritative Server and Recursor allows incomplete incremental zone transfers (IXFR) to be incorrectly marked as successful due to insufficient validation of transfer end conditions. This affects organizations running vulnerable versions of PowerDNS that use IXFR for DNS zone synchronization. Attackers could exploit this to cause DNS data inconsistency between primary and secondary servers.
💻 Affected Systems
- PowerDNS Authoritative Server
- PowerDNS Recursor
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Recursor by Powerdns
Recursor by Powerdns
Recursor by Powerdns
⚠️ Risk & Real-World Impact
Worst Case
DNS zone data corruption leading to DNS resolution failures, service disruption, or DNS cache poisoning if inconsistent data propagates through the DNS hierarchy.
Likely Case
Secondary DNS servers receiving incomplete zone data, causing DNS resolution inconsistencies and potential service availability issues for domains served by affected servers.
If Mitigated
Limited to minor DNS synchronization issues that can be detected and corrected through monitoring and manual intervention.
🎯 Exploit Status
Exploitation requires ability to trigger IXFR transfers, typically requiring access to primary DNS server or ability to manipulate zone data. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Authoritative: 4.4.3, 4.5.4, 4.6.1; Recursor: 4.4.8, 4.5.8, 4.6.1
Vendor Advisory: https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html
Restart Required: Yes
Instructions:
1. Identify affected PowerDNS version. 2. Backup configuration and zone data. 3. Upgrade to patched version using package manager (apt/yum) or compile from source. 4. Restart PowerDNS service. 5. Verify zone transfers complete successfully.
🔧 Temporary Workarounds
Disable IXFR
allConfigure PowerDNS to use only AXFR (full zone transfers) instead of IXFR
# In pdns.conf: ixfr=no
# In recursor.conf: ixfr=no
Increase IXFR validation
allImplement additional monitoring and validation of IXFR transfers
# Monitor zone serial numbers: pdns_control show-zones
# Check transfer logs regularly
🧯 If You Can't Patch
- Implement strict monitoring of zone serial numbers and transfer logs to detect incomplete transfers
- Configure secondary servers to perform periodic AXFR transfers to ensure data consistency
🔍 How to Verify
Check if Vulnerable:
Check PowerDNS version: pdns_server --version or pdns_recursor --version and compare against affected versionsCheck Version:
pdns_server --version 2>/dev/null || pdns_recursor --version 2>/dev/nullVerify Fix Applied:
Verify version is patched and test IXFR transfers between primary and secondary servers📡 Detection & Monitoring
Log Indicators:
- IXFR transfer completion without proper validation
- Zone serial number mismatches between servers
- Unexpected zone transfer failures
Network Indicators:
- Incomplete DNS zone data in responses
- Inconsistent DNS records between primary and secondary servers
SIEM Query:
source="powerdns" AND ("IXFR" OR "zone transfer") AND ("incomplete" OR "failed" OR "mismatch")🔗 References
- http://www.openwall.com/lists/oss-security/2022/03/25/1
- https://doc.powerdns.com/authoritative/security-advisories/index.html
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html
- https://docs.powerdns.com/recursor/security-advisories/index.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QKN56VWXUVFOYGUN75N5IRNK66OHTHT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEABZA46XYEUWMGSY2GYYVHISBVWEHIO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPHOFNI7FKM5NNOVDOWO4TBXFAFICCUE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJSKICB67SPPEGNXCQLZVSWR6QGCN3KP/
- http://www.openwall.com/lists/oss-security/2022/03/25/1
- https://doc.powerdns.com/authoritative/security-advisories/index.html
- https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2022-01.html
- https://docs.powerdns.com/recursor/security-advisories/index.html
- https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-01.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QKN56VWXUVFOYGUN75N5IRNK66OHTHT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEABZA46XYEUWMGSY2GYYVHISBVWEHIO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPHOFNI7FKM5NNOVDOWO4TBXFAFICCUE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJSKICB67SPPEGNXCQLZVSWR6QGCN3KP/
