CVE-2022-38177

Summary

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Affected Software

VendorProductVersion RangeStatus
ISCBIND9Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33affected
ISCBIND9Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1affected
ISCBIND9Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1affected

Weaknesses

  • In BIND 9.8.4 -> 9.16.32 and versions 9.9.4-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, the DNSSEC verification code for the ECDSA algorithm leaks memory when there is a signature length mismatch.

Workarounds

Disable the following algorithms in your configuration using the disable-algorithms option: ECDSAP256SHA256, ECDSAP384SHA384. Note that this causes zones signed with these algorithms to be treated as insecure.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References