CVE-2022-3080 BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

2022-09-2100:00:00

isc

www.cve.org

cve-2022-3080

bind 9

resolvers

stale cache

named crash

resolver vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.9%

JSON

By sending specific queries to the resolver, an attacker can cause named to crash.

CNA Affected

[
  {
    "vendor": "ISC",
    "product": "BIND9",
    "versions": [
      {
        "version": "Open Source Branch 9.16 9.16.14 through versions before 9.16.33",
        "status": "affected"
      },
      {
        "version": "Open Source Branch 9.18 9.18.0 through versions before 9.18.7",
        "status": "affected"
      },
      {
        "version": "Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1",
        "status": "affected"
      },
      {
        "version": "Development Branch 9.19 9.19.0 through versions before 9.19.5",
        "status": "affected"
      }
    ]
  }
]