Important: bind

Issue Overview:

A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to obtain and pass on potentially incorrect answers. This flaw allows a remote attacker to manipulate cache results with incorrect records, leading to queries made to the wrong servers, possibly resulting in false information received on the client’s end. (CVE-2021-25220)

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver’s performance, effectively denying legitimate clients access to the DNS resolution service. (CVE-2022-2795)

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. (CVE-2022-38177)

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. (CVE-2022-38178)

Affected Packages:

bind

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update bind to update your system.

New Packages:

aarch64:  
    bind-9.11.4-26.P2.amzn2.13.aarch64  
    bind-pkcs11-9.11.4-26.P2.amzn2.13.aarch64  
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.aarch64  
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.aarch64  
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.aarch64  
    bind-sdb-9.11.4-26.P2.amzn2.13.aarch64  
    bind-libs-lite-9.11.4-26.P2.amzn2.13.aarch64  
    bind-libs-9.11.4-26.P2.amzn2.13.aarch64  
    bind-utils-9.11.4-26.P2.amzn2.13.aarch64  
    bind-devel-9.11.4-26.P2.amzn2.13.aarch64  
    bind-lite-devel-9.11.4-26.P2.amzn2.13.aarch64  
    bind-chroot-9.11.4-26.P2.amzn2.13.aarch64  
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.aarch64  
    bind-export-libs-9.11.4-26.P2.amzn2.13.aarch64  
    bind-export-devel-9.11.4-26.P2.amzn2.13.aarch64  
    bind-debuginfo-9.11.4-26.P2.amzn2.13.aarch64  
  
i686:  
    bind-9.11.4-26.P2.amzn2.13.i686  
    bind-pkcs11-9.11.4-26.P2.amzn2.13.i686  
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.i686  
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.i686  
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.i686  
    bind-sdb-9.11.4-26.P2.amzn2.13.i686  
    bind-libs-lite-9.11.4-26.P2.amzn2.13.i686  
    bind-libs-9.11.4-26.P2.amzn2.13.i686  
    bind-utils-9.11.4-26.P2.amzn2.13.i686  
    bind-devel-9.11.4-26.P2.amzn2.13.i686  
    bind-lite-devel-9.11.4-26.P2.amzn2.13.i686  
    bind-chroot-9.11.4-26.P2.amzn2.13.i686  
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.i686  
    bind-export-libs-9.11.4-26.P2.amzn2.13.i686  
    bind-export-devel-9.11.4-26.P2.amzn2.13.i686  
    bind-debuginfo-9.11.4-26.P2.amzn2.13.i686  
  
noarch:  
    bind-license-9.11.4-26.P2.amzn2.13.noarch  
  
src:  
    bind-9.11.4-26.P2.amzn2.13.src  
  
x86_64:  
    bind-9.11.4-26.P2.amzn2.13.x86_64  
    bind-pkcs11-9.11.4-26.P2.amzn2.13.x86_64  
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.x86_64  
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.x86_64  
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.x86_64  
    bind-sdb-9.11.4-26.P2.amzn2.13.x86_64  
    bind-libs-lite-9.11.4-26.P2.amzn2.13.x86_64  
    bind-libs-9.11.4-26.P2.amzn2.13.x86_64  
    bind-utils-9.11.4-26.P2.amzn2.13.x86_64  
    bind-devel-9.11.4-26.P2.amzn2.13.x86_64  
    bind-lite-devel-9.11.4-26.P2.amzn2.13.x86_64  
    bind-chroot-9.11.4-26.P2.amzn2.13.x86_64  
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.x86_64  
    bind-export-libs-9.11.4-26.P2.amzn2.13.x86_64  
    bind-export-devel-9.11.4-26.P2.amzn2.13.x86_64  
    bind-debuginfo-9.11.4-26.P2.amzn2.13.x86_64  

Additional References

Red Hat: CVE-2021-25220, CVE-2022-2795, CVE-2022-38177, CVE-2022-38178

Mitre: CVE-2021-25220, CVE-2022-2795, CVE-2022-38177, CVE-2022-38178