PublicCVE
Log inSign up

CVE-2022-38177

HIGH7.5JSON exportCreate alert

Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

CVSS breakdown

CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected products

  • ISC / BIND9Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33 – Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33
  • ISC / BIND9Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1 – Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1
  • ISC / BIND9Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 – Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1

References