8 results · Feed
-
Medium —
Netfoil doesn't decrement TTL
### Summary TTL was not decremented, so stale records would continue to be served.
-
Low —
netfoil vulnerable to improper handling of untrusted DoH response data
### Summary HTTPS RR data returned from the DoH server was not properly handled. Unverified APLN data (which could contain arbitrary byte sequences) was written directly to the log. It could also cause unnecessary memory usage. The single-byte response code w…
-
High —
netfoil: Incorrect block responses could lead to localhost traffic
### Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost rather than just dropped. ### Impact Unintended traffic could be sent to localhost. Impact depends o…
-
Low —
netfoil: Attacker controlled data written to logs
### Summary Domain names were written to the log without first being validated to contain allowed characters. ### Impact Depends on how the logs were used.
-
Low —
netfoil has a resource leak in LRU cache
### Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. ### Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger servic…
-
Medium —
netfoil has a domain name filter bypass via multiple questions
### Summary Potential bypass of domain name filter by crafting a DNS request with multiple questions, with the first question being legitimate. ### Impact Depends on a local attackers ability to craft multiple questions and the remote DoH server supporting th…
-
Medium —
netfoil's optional seccomp sandboxing was not applied
### Summary The optional flag `--filter-system-calls` was not applied even if specified. ### Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd…
-
Medium —
Netfoil has incorrect allowlist enforcement
### Summary Rules could be bypassed by changing the first character: `example.com` could be be bypassed by e.g. `fxample.com`. ### Details Off-by-one error in the suffixtrie implementation. ### Impact The domain filter could be bypassed. Please note that DNS …