Fedora 44 PowerDNS Recursor Critical Bypass — Upgrade to 5.4.6 Now (Advisory 2026-ae048e451f)

---
title: pdns-recursor Configuration Modification or Unauthorized Reload
id: 8f2c1a94-6b3d-4e71-9a05-2c7d4f8e1b36
status: experimental
description: Detects modification of pdns-recursor configuration files or service restarts outside of change windows, which may indicate an attacker weakening resolver security settings (e.g. disabling DNSSEC validation, widening ACLs) to exploit a validation bypass.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-pdns-recursor-2026-ae048e451f
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.t1562
logsource:
  product: linux
  service: auditd
detection:
  selection_paths:
    name|contains:
      - '/etc/pdns-recursor/'
      - '/etc/recursor.conf'
      - '/etc/pdns/recursor.conf'
  selection_write:
    type: 'PATH'
    nametype:
      - 'CREATE'
      - 'NORMAL'
  condition: selection_paths and selection_write
falsepositives:
  - Legitimate configuration management (Ansible, Puppet) runs
  - Package upgrade writing new config templates
level: medium
---
title: pdns-recursor Spawning Unexpected Child Processes
id: 3b7e5f12-9c4a-4d28-b6f1-5a8c2e9d7f40
status: experimental
description: Detects the pdns-recursor daemon spawning shells or system utilities. A resolver daemon has no legitimate reason to execute command interpreters; this behavior post-exploitation of any recursor flaw is a strong compromise indicator.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-pdns-recursor-2026-ae048e451f
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/pdns_recursor'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; Lua scripting hooks in recursor configs invoking external tools (review if custom Lua is deployed)
level: high
---
title: Excessive NXDOMAIN or Anomalous Query Volume to Recursive Resolver
id: 6d1a9c83-2e5b-4f74-a3c8-9b4e7d2f5a19
status: experimental
description: Detects sustained bursts of NXDOMAIN responses or query patterns consistent with cache-snooping or cache-poisoning attempts against a recursive resolver, a common precursor/companion behavior when exploiting resolver validation weaknesses.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-pdns-recursor-2026-ae048e451f
  - https://attack.mitre.org/techniques/T1071.004/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
  category: dns
detection:
  selection:
    rcode: 'NXDOMAIN'
  timeframe: 5m
  condition: selection | count(query) by src_ip > 200
falsepositives:
  - Security tooling performing DNS-based enumeration
  - Misbehaving IoT/printer firmware generating failed lookups
level: low

// Hunt: pdns-recursor version exposure and anomaly signals from Syslog ingestion
// Covers: (1) inventory of hosts running pdns-recursor, (2) service restart/crash events
// that may indicate crash-trigger exploitation attempts, (3) abnormal query logging.

// --- Part 1: Hosts with pdns-recursor activity (exposure inventory) ---
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has "pdns" or SyslogMessage has "pdns_recursor"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            SampleMessage=any(SyslogMessage), EventCount=count()
  by Computer, ProcessName
| sort by EventCount desc;

// --- Part 2: Recursor restarts, crashes, or security-relevant log lines ---
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName has "pdns" or SyslogMessage has "pdns_recursor"
| where SyslogMessage has_any ("starting", "shutdown", "exiting", "segfault",
                               "Refused", "validation", "bogus", "servfail",
                               "reload", "ACL")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated desc;

// --- Part 3: DNS via CommonSecurityLog (CEF-ingested resolver/firewall logs) —
// clients generating extreme NXDOMAIN volume against internal resolvers ---
CommonSecurityLog
| where TimeGenerated > ago(1h)
| where DeviceProduct has "dns" or ApplicationProtocol == "dns"
| where Message has "NXDOMAIN"
| summarize NXDCount=count() by SourceIP, DestinationIP
| where NXDCount > 200
| sort by NXDCount desc;

-- Artifact: SecurityArsenal.Linux.PdnsRecursor.Exposure
-- Purpose: Identify hosts running vulnerable pdns-recursor versions and
--          inspect the daemon's listening sockets and child processes.

-- Step 1: Confirm installed package version (RPM-based Fedora 44 hosts)
LET rpm_check = SELECT * FROM execve(
    argv=['rpm', '-q', 'pdns-recursor', '--queryformat',
          '%{NAME}-%{VERSION}-%{RELEASE}\n']
)

SELECT Stdout AS InstalledPackage FROM rpm_check;

-- Step 2: Verify the daemon process and enumerate child processes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'pdns'
   OR Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'pdns_recursor');

-- Step 3: Confirm the resolver's listening sockets are scoped as expected
-- (exposure check: recursor bound to 0.0.0.0 when it should be internal-only)
SELECT Pid, Name, Laddr, Lport, Status
FROM netstat()
WHERE Name =~ 'pdns'
  AND Lport IN (53, 853);

#!/usr/bin/env bash
# Fedora 44 pdns-recursor 5.4.6 remediation + verification script
# Advisory: 2026-ae048e451f / rhbz#2527899
set -euo pipefail

FIXED_VERSION="5.4.6"

# --- 1. Check current exposure ---
echo "[*] Current pdns-recursor package:"
rpm -q pdns-recursor || { echo "[+] pdns-recursor not installed. Exiting."; exit 0; }

CURRENT=$(rpm -q pdns-recursor --queryformat '%{VERSION}')
echo "[*] Installed version: ${CURRENT} (fixed: ${FIXED_VERSION})"

# --- 2. Apply the update ---
echo "[*] Updating pdns-recursor via dnf..."
dnf upgrade -y --refresh pdns-recursor

NEW=$(rpm -q pdns-recursor --queryformat '%{VERSION}')
if [[ "${NEW}" != "${FIXED_VERSION}"* ]]; then
  echo "[!] WARNING: post-update version is ${NEW}; expected ${FIXED_VERSION}." >&2
  exit 1
fi

# --- 3. Restart and verify the service ---
systemctl restart pdns-recursor
sleep 2
systemctl is-active --quiet pdns-recursor \
  && echo "[+] pdns-recursor active on ${NEW}" \
  || { echo "[!] Service failed to start — check journalctl -u pdns-recursor" >&2; exit 1; }

# --- 4. Confirm running binary version ---
pdns_recursor --version | head -n1

# --- 5. Hardening sanity checks ---
echo "[*] Auditing listen scope (recursor should not answer the internet unless intended):"
ss -ulnp | grep -E ':53\s' || true
ss -tlnp | grep -E ':53\s' || true

# --- 6. Functional smoke test ---
echo "[*] Smoke test resolution:"
dig +short @127.0.0.1 example.com >/dev/null \
  && echo "[+] Resolution OK" \
  || echo "[!] Local resolution failed — investigate before returning to service" >&2

# --- 7. Flush cache after patch to clear any poisoned entries ---
rec_control wipe-cache '$' 2>/dev/null && echo "[+] Cache wiped" || echo "[*] rec_control unavailable — restart already cleared cache"

echo "[+] Remediation complete: pdns-recursor ${NEW} (fixes rhbz#2527899)"