The vulnerability in Unbound (CVE-2024-1488) stems from incorrect default permissions that permit any process outside the unbound group to modify the runtime configuration if it can connect to localhost on port 8953. The default configuration with "control-use-cert: no" and IP-based "control-interface" allows improper access. An attacker with local access can manipulate the running Unbound instance, potentially changing forwarders to monitor DNS queries or disrupt DNS resolution. Red Hat advisories for RHEL 8 and 9 provide updated Unbound packages that mitigate this by introducing a new configuration file (/etc/unbound/conf.d/remote-control.conf) which sets "control-interface" to a Unix socket and enables "control-use-cert: yes" to restrict access. Verification can be done using "unbound-control status | grep control" to check if SSL or named pipe control is enabled, indicating a non-vulnerable configuration. The advisories recommend updating to the fixed packages and adjusting configuration files accordingly.

An unprivileged local attacker can connect to the Unbound control interface on localhost port 8953 and modify the runtime configuration. This can lead to manipulation of DNS forwarders, enabling tracking of all queries forwarded by the local resolver, and potentially disrupting DNS resolution. The vulnerability allows unauthorized configuration changes, which can compromise confidentiality and integrity of DNS operations and availability of DNS resolution.

Red Hat has released updated Unbound packages for RHEL 8 and 9 that address this vulnerability. The fix involves adding a new configuration file (/etc/unbound/conf.d/remote-control.conf) that restricts control access to a Unix socket and enables certificate-based authentication (control-use-cert: yes). Users should update to the patched versions provided by Red Hat advisories RHSA-2024:1750 and RHSA-2024:1751. To verify if a system is vulnerable, run "unbound-control status | grep control"; output containing "control(ssl)" or "control(namedpipe)" indicates a non-vulnerable configuration. If only "control" is returned, the system is vulnerable and should be fixed by including the new configuration file or adding the directives to custom control configuration files. Follow Red Hat's update instructions at https://access.redhat.com/articles/11258.