CVE-2021-25215high

CVE-2021-25215: high-severity vulnerability in ISC BIND9

An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

Published · Updated

Follow this CVE+ Monitor BIND9+ Monitor bind9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 12%
In short

A bug in BIND DNS software causes the server to crash when processing certain DNS queries for DNAME records. An attacker can send a specially crafted query to make the DNS service stop working.

Technical detail

The vulnerability exists in BIND's DNAME record processing logic where a failed assertion check causes the named process to terminate. An unauthenticated attacker can trigger a denial of service by sending a query for a DNAME record that requires recursive processing, affecting BIND versions 9.0.0 through 9.17.11 across multiple branches.

Summary generated and translated by AI from the official description.
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
ISC · BIND9
Related CVEs — ISC BIND9

In the same product, most dangerous first.

CVE-2020-8617HIGHA logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.cEPSS 93.3%CVE-2021-25216HIGHA second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 83.0%CVE-2020-8625HIGHA vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 64.2%CVE-2021-25219MEDIUMLame cache can be abused to severely degrade resolver performanceEPSS 11.2%CVE-2020-8616HIGHBIND does not sufficiently limit the number of fetches performed when processing referralsEPSS 10.9%CVE-2020-8623HIGHA flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cEPSS 6.6%