The unbound DNS resolver in Red Hat Enterprise Linux versions 8 and 9 contains two vulnerabilities. CVE-2024-1488 arises from incorrect default permissions allowing any local process to modify the unbound runtime configuration via the control interface on localhost port 8953, enabling potential local privilege escalation. The vulnerability is mitigated by adding a new configuration file (/etc/unbound/conf.d/remote-control.conf) that restricts control interface access to members of the unbound group and enforces certificate usage. CVE-2024-8508 involves unbounded name compression that could lead to denial of service conditions. Red Hat has released updated packages (e.g., unbound-1.16.2-5.8.el8_10) for affected architectures and versions, including x86_64, aarch64, ppc64le, and s390x, to fix these issues. The vendor advisory provides detailed instructions for verifying and applying the fix.

CVE-2024-1488 allows an unprivileged local process to alter the running unbound DNS resolver configuration, potentially leading to local privilege escalation and manipulation of DNS forwarding behavior. CVE-2024-8508 could cause denial of service through unbounded name compression. These vulnerabilities impact the integrity and availability of the DNS resolver service on affected Red Hat Enterprise Linux systems.

Red Hat has released official security updates that address these vulnerabilities. Users should apply the updated unbound packages provided in the advisory (e.g., unbound-1.16.2-5.8.el8_10 for RHEL 8 and corresponding updates for RHEL 9). Additionally, verify that the unbound configuration includes the new remote-control.conf file with directives to restrict control interface access and enable certificate usage. Use the command 'unbound-control status | grep control' to confirm that the configuration is not vulnerable. Systems updated with these packages and configuration changes are considered protected. No further action is required beyond applying the official patches and configuration updates.