CVE-2024-1488

Q: What is the severity of CVE-2024-1488?

CVE-2024-1488 has a CVSS score of 8.0 (HIGH). This CVE allows any local process to modify Unbound DNS resolver's runtime configuration via port 8953 due to incorrect default permissions. Attackers can alter DNS forwarders to intercept or disrupt DNS queries. Systems running vulnerable Unbound versions with default configurations are affected.

8.0 HIGH

📋 TL;DR

This CVE allows any local process to modify Unbound DNS resolver's runtime configuration via port 8953 due to incorrect default permissions. Attackers can alter DNS forwarders to intercept or disrupt DNS queries. Systems running vulnerable Unbound versions with default configurations are affected.

💻 Affected Systems

Products:

Unbound DNS resolver

Versions: Specific versions not detailed in CVE, but Red Hat advisories indicate affected RHEL versions with Unbound packages.

Operating Systems: Linux distributions with vulnerable Unbound packages, particularly Red Hat Enterprise Linux variants

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerable when Unbound is running with default configuration allowing local connections to control port 8953.

📦 What is this software?

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Unbound by Fedoraproject

View all CVEs affecting Unbound →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete DNS resolution disruption, DNS query interception leading to credential theft or malware distribution via DNS hijacking.

🟠

Likely Case

DNS query monitoring and potential redirection to malicious DNS servers for traffic interception.

🟢

If Mitigated

Limited impact if proper network segmentation and access controls prevent unauthorized local connections.

🌐 Internet-Facing: LOW - Requires local network access to port 8953, not directly internet exploitable.

🏢 Internal Only: HIGH - Any local process can exploit this, making internal lateral movement and privilege escalation possible.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires local network access to port 8953 but no authentication. Simple network connection and configuration modification commands needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for patched versions (RHSA-2024:1750, RHSA-2024:1751, etc.)

Vendor Advisory: https://access.redhat.com/errata/RHSA-2024:1750

Restart Required: Yes

Instructions:

1. Update Unbound package using system package manager. 2. For RHEL: 'sudo yum update unbound'. 3. Restart Unbound service: 'sudo systemctl restart unbound'.

🔧 Temporary Workarounds

Restrict localhost access to control port

linux

Configure Unbound to only allow connections from specific users/groups or disable remote control.

Edit /etc/unbound/unbound.conf
Add: control-interface: 127.0.0.1
Add: control-use-cert: yes
Set proper file permissions on config

Firewall restriction

linux

Block unauthorized access to port 8953 using local firewall rules.

sudo iptables -A INPUT -p tcp --dport 8953 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8953 -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to isolate Unbound from untrusted local processes.
Monitor and alert on unauthorized connections to port 8953 using network monitoring tools.

🔍 How to Verify

Check if Vulnerable:

Check if Unbound is running and listening on port 8953: 'sudo netstat -tlnp | grep 8953' and verify config permissions.

Check Version:

unbound -V or rpm -q unbound or dpkg -l unbound

Verify Fix Applied:

Verify updated package version: 'rpm -q unbound' (RHEL) or equivalent, and test that unauthorized local connections to port 8953 are blocked.

📡 Detection & Monitoring

Log Indicators:

Unauthorized connection attempts to port 8953 in system logs
Unbound configuration changes in audit logs

Network Indicators:

Unexpected traffic to/from port 8953
DNS forwarder changes leading to unusual DNS patterns

SIEM Query:

source="unbound.log" AND ("connection refused" OR "unauthorized" OR "control") OR destination_port=8953 AND NOT source_ip=127.0.0.1

📊 Metadata

CVE ID: CVE-2024-1488

CVSS v3 Score: 8.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

CWE: CWE-276

Published: February 15, 2024

Last Updated: January 30, 2025

🔗 References

https://access.redhat.com/errata/RHSA-2024:1750 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1751 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1780 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1801 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1802 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2587 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2696 Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:0837
https://access.redhat.com/security/cve/CVE-2024-1488 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2264183 Issue Tracking,Patch
https://access.redhat.com/errata/RHSA-2024:1750 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1751 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1780 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1801 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1802 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1804 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2587 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2696 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-1488 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2264183 Issue Tracking,Patch

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Codeready Linux Builder by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus For Power Little Endian by Redhat

Codeready Linux Builder Eus For Power Little Endian by Redhat

Codeready Linux Builder For Arm64 by Redhat

Codeready Linux Builder For Arm64 by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Ibm Z Systems by Redhat

Codeready Linux Builder For Ibm Z Systems by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Enterprise Linux by Redhat

Enterprise Linux by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux For Arm 64 by Redhat

Enterprise Linux For Arm 64 by Redhat

Enterprise Linux For Arm 64 by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Arm 64 Eus by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Unbound by Fedoraproject

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict localhost access to control port

Firewall restriction

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities