Memory Leak Vulnerability in bind Package
Summary
CVE-2022-38178: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. Affects bind across 6 version ranges.
>= 4eb49c48823a2abbe0b3784305906cce5f520a4c, <= 3f3dd451af293119716d912c77a6da5918bf523a
< 9.16.33-r0
< 617639b7cc40ba9eb6fde2d98099726d50da812e
>= a37581543167cd471036b0d43e767c9ffb825625, <= 56f34392636ebe6fa38d0a687453aec2b8a593a4
>= db65d701b999d10e555c13454bceb74df4494975, <= 12f71327ff796ed24752a4286fc0b3d9b21a4a57
< eba38b89007f65bc6c1fdd2451034bbe3908b9a4
Fixed in 9.16.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bind package is a DNS server implementation that provides domain name resolution services. It is widely used in various operating systems and distributions. The vulnerability identified as CVE-2022-38178 affects the bind package and can be exploited by an attacker to trigger a small memory leak. By spoofing the target resolver with responses that have a malformed EdDSA signature, the attacker can gradually erode available memory, potentially causing the named process to crash due to lack of resources.
Vulnerability Detail
The CVE-2022-38178 vulnerability allows an attacker to exploit the bind package by sending responses with malformed EdDSA signatures. This triggers a small memory leak that can gradually deplete available memory. If the attack continues, the named process may crash due to insufficient resources. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity level. It is important to address this vulnerability promptly to prevent potential denial-of-service attacks.
How To Fix
Minimum fixed version
9.16.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the bind package to the latest version.
Conclusion
The memory leak vulnerability in the bind package (CVE-2022-38178) can be exploited by an attacker to gradually deplete available memory, potentially leading to a denial-of-service situation. It is crucial to update the bind package to version 9.16.33-r0 or later to mitigate this vulnerability. Regularly updating the bind package is recommended to stay protected against future vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bind →
FAQ
The bind package is a DNS server implementation that provides domain name resolution services.
The vulnerability can lead to a small memory leak, potentially causing the named process to crash due to lack of resources.
To fix the vulnerability, update the bind package to version 9.16.33-r0 or later.
No specific workaround is mentioned. It is recommended to update the bind package to the latest version.
The CVSSv3 score of CVE-2022-38178 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
