CVE-2023-50387 Vulnerability

This vulnerability stems from an algorithmic complexity flaw within the DNSSEC validation process. When a resolver receives a DNS response containing a large number of cryptographic keys and signatures, it attempts to verify every possible key-signature combination. The absence of computational limits or safeguards in the validation routine allows an attacker to send a malicious DNS response that triggers excessive cryptographic computations.

Example behavior:

dig @ example.dnssec-malicious-domain.com +dnssec

A malicious domain can return thousands of DNSKEY and RRSIG records, causing full CPU utilization on the resolver during validation. This flaw allows attackers to render the resolver unresponsive—disrupting DNS resolution for entire networks and services. While it does not enable arbitrary code execution, it critically impacts availability at scale.

Tactics, techniques & procedures (TTPs)

Adversaries can exploit CVE-2023-50387 by:

• Operating a malicious DNS zone that sends crafted DNSSEC responses.

• Leveraging compromised or misconfigured DNS servers to redirect resolver queries to malicious domains.

• Conducting amplified DoS attacks targeting recursive resolvers that perform DNSSEC validation.

These attacks can disrupt internet-facing applications, VPNs, and web services reliant on the affected resolvers.

Indicators of Compromise

Organizations should monitor for:

• Sustained or unexplained high CPU usage on DNS resolvers.

• DNS query timeouts or resolution failures across client networks.

• Logs showing repeated queries to suspicious or unknown DNSSEC-enabled domains.

Indicators may include:

• DNS queries to domains hosting oversized DNSKEY and RRSIG sets.

• Outbound connections from resolvers to unexpected authoritative servers.

• Increased latency or resource exhaustion alerts in monitoring tools.

Known Proof-of-Concepts & Exploits

As of publication, no public proof-of-concept exploit has been released, but research details from ATHENE’s KeyTrap paper demonstrate reproducible conditions. Major vendors and national CERTs have warned that exploitation is practical and easily weaponizable, with potential for large-scale service disruption if left unpatched.