Unbound SO_REUSEPORT Source Port Predictability DNS Cache Poisoning

Technical Analysis

Unbound partitions its UDP source port space into disjoint subsets assigned to worker threads at startup, and when SO_REUSEPORT is enabled, incoming queries are deterministically routed to threads based on source IP and port via kernel-level load balancing. This deterministic mapping allows an attacker who observes or influences a client's source port to identify which thread (and thus which reduced port subset) will handle resolution of a spoofed domain, materially lowering the effective randomness relied upon to prevent off-path DNS cache poisoning (the classic Kaminsky-style attack surface). Successful exploitation enables an attacker to inject forged DNS responses into the resolver's cache, redirecting resolution for arbitrary domains to attacker-controlled infrastructure. Any AI agent, RAG pipeline, or autonomous system that relies on this resolver for DNS resolution of API endpoints, package repositories, model weight downloads, or tool-calling destinations could be silently redirected to malicious hosts, enabling credential theft, malicious payload delivery, or man-in-the-middle interception of agent traffic.

Affected Systems

NLnet Labs Unbound versions 1.4.22 through 1.25.1 with 'so-reuseport: yes' configured (default setting); affects resolvers deployed as recursive DNS servers, including those used in enterprise networks, cloud infrastructure, and as upstream resolvers for containerized/agent environments.

Indicators of Compromise

• No specific file hashes, IPs, or domains associated - this is a protocol-level design vulnerability requiring configuration remediation rather than signature-based detection.

Remediation Steps

1. 1

   Upgrade Unbound

   Update to the latest patched version of Unbound once NLnet Labs releases a fix addressing the port-subset predictability issue.

2. 2

   Disable or reconfigure SO_REUSEPORT

   As an interim mitigation, set 'so-reuseport: no' in unbound.conf to eliminate deterministic thread-to-port mapping, weighing the performance tradeoff against security.

3. 3

   Deploy DNS transaction hardening

   Enable and enforce 0x20 encoding, query name case randomization, and DNSSEC validation to add additional layers of entropy and integrity verification independent of source port randomization.

4. 4

   Monitor for anomalous DNS responses

   Deploy DNS monitoring to detect unexpected response patterns, duplicate query IDs, or cache anomalies indicative of poisoning attempts.

5. 5

   Audit agent and automation DNS dependencies

   Review AI agent, RAG, and automation pipelines that depend on internal resolvers to ensure DNSSEC validation and TLS certificate pinning are enforced for critical API and package repository endpoints, reducing impact if cache poisoning succeeds.