CVE-2022-3488highCWE-617

CVE-2022-3488: high-severity vulnerability in ISC BIND 9

named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries

Published · Updated

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 19%
exploitation probability
19%top 3% of all CVEs
observed exploitation
nono source reports it
In short

BIND DNS server crashes when it receives certain malformed responses with ECS options during repeated DNS queries. This causes the DNS service to stop working, affecting all users relying on that server.

Technical detail

An attacker can trigger an assertion failure in BIND's ECS (EDNS Client Subnet) option processing by sending crafted responses to iterative queries where the first response contains invalid ECS data (e.g., mismatched query/answer names) followed by a second valid response. The vulnerability affects BIND 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1, resulting in DoS via process termination.

Summary generated and translated by AI from the official description.
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
ISC · BIND 9
Related CVEs — ISC BIND 9

In the same product, most dangerous first.

CVE-2018-5740HIGHA flaw in the "deny-answer-aliases" feature can cause an assertion failure in namedEPSS 59.6%CVE-2022-3736HIGHnamed configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesEPSS 48.7%CVE-2017-3145HIGHImproper fetch cleanup sequencing in the resolver can cause named to crashEPSS 27.9%CVE-2024-12705HIGHDNS-over-HTTPS implementation suffers from multiple issues under heavy query loadEPSS 18.4%CVE-2017-3143HIGHAn error in TSIG authentication can permit unauthorized dynamic updatesEPSS 18.3%CVE-2017-3135HIGHCombination of DNS64 and RPZ Can Lead to CrashEPSS 17.2%
References
https://kb.isc.org/docs/cve-2022-3488