Memory Exhaustion Denial of Service in bind
Summary
CVE-2022-2906: An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Affects bind across 3 version ranges.
>= 8db45afa1affcb823e68afdeddedf93e136f5d3e, < 85a6eb108e884467c4b3af414140d6b033a89a62
< 9.16.33-r0
>= cab15392afd841fe3b0bacd894003376d857459a, < 5b2fed25f4f7d2c08b38c4d94193715cdbb2e038
Fixed in 9.16.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bind is an open-source DNS server software that provides domain name resolution services. It is widely used across various operating systems and is responsible for translating domain names into IP addresses. The vulnerability, identified as CVE-2022-2906, affects bind versions prior to 9.16.33-r0 for Alpine:v3.13, v3.14, v3.15, v3.16, and versions prior to 9.18.7-r0 for Alpine:v3.17, v3.18. An attacker can exploit this vulnerability to gradually consume available memory, leading to a denial of service (DoS) condition. Upon restart, the attacker would need to initiate the attack again, but the potential for service disruption exists.
Vulnerability Detail
The vulnerability, CVE-2022-2906, allows an attacker to exhaust the memory resources of the bind DNS server. By exploiting this flaw, the attacker can gradually consume memory until the server crashes due to lack of resources. This can result in a denial of service, impacting the availability of DNS resolution services. The attacker would need to restart the attack after each server restart, but the potential for service disruption remains. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
9.16.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by updating bind to the fixed versions mentioned above.
Conclusion
The memory exhaustion denial of service vulnerability in bind can be mitigated by updating the software to the recommended fixed versions. It is crucial to promptly apply the fix to ensure the stability and availability of the bind DNS server. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
bind is an open-source DNS server software used for domain name resolution.
The vulnerability can lead to a denial of service (DoS) condition by exhausting the memory resources of the bind DNS server.
To fix this vulnerability, update bind to the recommended fixed versions.
No specific workaround is provided. Updating to the fixed versions is the recommended solution.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
