CVE-2022-38177

Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

CVSS breakdown

Affected products

• Debian / debian_linux11.0 – 11.0
• Debian / debian_linux10.0 – 10.0
• fedoraproject / fedora37 – 37
• fedoraproject / fedora35 – 35
• fedoraproject / fedora36 – 36
• ISC / BIND9.9.3 – 9.9.3
• ISC / BIND9.9.12 – 9.9.12
• ISC / BIND9.9.13 – 9.9.13
• ISC / BIND9.10.5 – 9.10.5
• ISC / BIND9.10.7 – 9.10.7
• ISC / BIND9.11.3 – 9.11.3
• ISC / BIND9.11.5 – 9.11.5
• ISC / BIND9.11.5 – 9.11.5
• ISC / BIND9.11.5 – 9.11.5
• ISC / BIND9.11.5 – 9.11.5
• ISC / BIND9.11.6 – 9.11.6
• ISC / BIND9.11.7 – 9.11.7
• ISC / BIND9.11.8 – 9.11.8
• ISC / BIND9.11.12 – 9.11.12
• ISC / BIND9.11.14-s1 – 9.11.14-s1
• ISC / BIND9.11.19-s1 – 9.11.19-s1
• ISC / BIND9.11.21 – 9.11.21
• ISC / BIND9.11.27 – 9.11.27
• ISC / BIND9.11.29 – 9.11.29
• ISC / BIND9.11.35 – 9.11.35
• ISC / BIND9.11.37 – 9.11.37
• ISC / BIND9.16.8 – 9.16.8
• ISC / BIND9.16.11 – 9.16.11
• ISC / BIND9.16.13 – 9.16.13
• ISC / BIND9.16.21 – 9.16.21
• ISC / BIND9.16.32 – 9.16.32
• ISC / BIND9.9.3 – 9.9.3
• ISC / BIND9.8.4 – 9.16.32
• ISC / BIND9Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33 – Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33
• ISC / BIND9Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1 – Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1
• ISC / BIND9Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 – Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1
• NetApp / active_iq_unified_manager

References

• MISChttps://kb.isc.org/docs/cve-2022-38177
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2022/09/21/3
• VENDOR_ADVISORYhttps://www.debian.org/security/2022/dsa-5235
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
• MISChttps://security.gentoo.org/glsa/202210-25
• MISChttps://security.netapp.com/advisory/ntap-20221228-0010/