Description
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | unbound | 1.16.2 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | unbound +3 | 1.16.2-3.el9_3.5 | RHSA-2024:1750 |
| RHEL 8 | unbound +3 | 1.16.2-5.el8_9.6 | RHSA-2025:0837, RHSA-2024:1751 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | unbound +3 | 1.16.2-3.el9_2.4 | RHSA-2024:1780 |
| RHEL 9.0 EUS | unbound +2 | 1.13.1-13.el9_0.4 | RHSA-2024:1801 |
| RHEL 8.8 EUS | unbound +3 | 1.16.2-5.el8_8.4 | RHSA-2024:1802 |
| RHEL 8.6 EUS | unbound +3 | 1.7.3-17.el8_6.4 | RHSA-2024:1804 |
| RHEL 8.4 TUS | unbound +3 | 1.7.3-15.el8_4.1 | RHSA-2024:2587 |
| RHEL 8.4 E4S | unbound +3 | 1.7.3-15.el8_4.1 | RHSA-2024:2587 |
| RHEL 8.4 AUS | unbound +3 | 1.7.3-15.el8_4.1 | RHSA-2024:2587 |
| RHEL 8.2 TUS | unbound +3 | 1.7.3-12.el8_2.1 | RHSA-2024:2696 |
| RHEL 8.2 E4S | unbound +3 | 1.7.3-12.el8_2.1 | RHSA-2024:2696 |
| RHEL 8.2 AUS | unbound +3 | 1.7.3-12.el8_2.1 | RHSA-2024:2696 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | unbound +3 | 1.16.2-3.el9_3.5 | ALSA-2024:1750 |
| AlmaLinux 8 | unbound +3 | 1.16.2-5.el8_9.6 | ALSA-2025:0837, ALSA-2024:1751 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | unbound | 1.16.2-3.el9_3.5 | RLSA-2024:1750 |
| Rocky Linux 8 | unbound | 1.16.2-5.el8_9.6 | RLSA-2025:0837, RLSA-2024:1751 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | unbound +5 | 1.17.1-1.amzn2023.0.3 | ALAS2023-2024-604 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | unbound +3 | 1.16.2-3.el9_3.5 | ELSA-2024-1750 |
| Oracle Linux 8 | unbound +3 | 1.16.2-5.el8_9.6 | ELSA-2025-0837, ELSA-2024-1751 |
Advisories 22
- ALSA-2024:1750 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:1751 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:0837 Important: unbound security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:0837 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2024:2696 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:2587 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:1804 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:1802 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:1801 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:1780 Red Hat Security Advisory: unbound security and bug fix update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:1751 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:1750 Red Hat Security Advisory: unbound security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- RLSA-2025:0837 Important: unbound security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:1751 Important: unbound security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:1750 Important: unbound security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2024-1086 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 19, 2025
- WID-SEC-2024-0844 Red Hat Enterprise Linux: Schwachstelle in unbound BSI CERT-Bund (WID) · Jan 30, 2025
- ELSA-2025-0837 Important: unbound security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 30, 2025
- ALAS2023-2024-604 Important: unbound security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 25, 2024
- ELSA-2024-1751 Important: unbound security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 11, 2024
- ELSA-2024-1750 Important: unbound security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2024
References
- RHSA-2024:1750 vendor-advisory
- RHSA-2024:1751 vendor-advisory
- RHSA-2024:1780 vendor-advisory
- RHSA-2024:1801 vendor-advisory
- RHSA-2024:1802 vendor-advisory
- RHSA-2024:1804 vendor-advisory
- RHSA-2024:2587 vendor-advisory
- RHSA-2024:2696 vendor-advisory
- RHSA-2025:0837 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-1488 vdb-entry
- RHBZ#2264183 issue-tracking