CVE-2022-2906 Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)

2022-09-2110:15:27

isc

www.cve.org

cve-2022-2906

memory leaks

openssl 3.0.0+

diffie-hellman

deny service

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

CNA Affected

[
  {
    "vendor": "ISC",
    "product": "BIND9",
    "versions": [
      {
        "version": "Open Source Branch 9.18 9.18.0 through versions before 9.18.7",
        "status": "affected"
      },
      {
        "version": "Development Branch 9.19 9.19.0 through versions before 9.19.5",
        "status": "affected"
      }
    ]
  }
]