TS-2024-007

Description: Incorrect DNS resolution with split DNS on macOS and iOS What happened? On Tailscale macOS and iOS clients with split DNS configurations (like App Connectors or Restricted Nameservers), lookups of bare tailnet node names could in rare cases return incorrect answers. For example, if a node mynode and an App Connector for *.example.com exist on a tailnet, DNS lookups for mynode could return the answer for mynode.example.com instead of the local tailnet IP. This mis-configuration is intermittent, and most often triggers for a few seconds when switching device networks (for example from Wi-Fi to a phone hotspot). We fixed this bug in client version 1.68.0, and notified the security contacts of potentially affected tailnets over email. Who was affected? All tailnets that use App Connectors or Restricted Domains, and have macOS or iOS nodes could have been affected. This bug is usually intermittently-triggered when switching networks in our experience. Only lookups of bare domains, like mynode but not mynode.mytailnet.ts.net, are at risk. Note that not all split DNS domains are dangerous. Only domains where an attacker can choose their FQDN to match a node name, and controls the destination to receive non-TLS traffic could be abused. We are not aware of any active exploitation of this vulnerability. What was the impact? For a split DNS domain example.com, an attacker with control over mynode.example.com can impersonate a non-TLS server running on node mynode on the tailnet. This attack is opportunistic and passive - it relies on the user connecting to mynode using its bare domain and cannot be forced remotely. What do I need to do? Upgrade your macOS and iOS clients to 1.68.0 or later.