CVE-2022-38177highCWE-401

CVE-2022-38177: fallo de gravedad alta en ISC BIND9

Memory leak in ECDSA DNSSEC verification code

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BIND9+ Monitorear bind9

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 3.3%
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
ISC · BIND9
CVEs relacionadas — ISC BIND9

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-8617HIGHA logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.cEPSS 93.3%CVE-2021-25216HIGHA second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 83.0%CVE-2020-8625HIGHA vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attackEPSS 64.2%CVE-2021-25215HIGHAn assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itselfEPSS 11.7%CVE-2021-25219MEDIUMLame cache can be abused to severely degrade resolver performanceEPSS 11.2%CVE-2020-8616HIGHBIND does not sufficiently limit the number of fetches performed when processing referralsEPSS 10.9%