|Summary:||CVE-2022-0396 bind: DoS from specifically crafted TCP packets|
|Product:||[Other] Security Response||Reporter:||TEJ RATHI <trathi>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||NEW ---||QA Contact:|
|Version:||unspecified||CC:||anon.amish, dns-sig, jorton, mosvald, mruprich, pavel, pemensik, security-response-team, suwu, tcrider, vonsch, yozone, zdohnal|
|Fixed In Version:||bind 9.16.27, bind 9.18.1||Doc Type:||If docs needed, set a value|
A flaw was found in Bind that incorrectly handles certain crafted TCP streams. The vulnerability allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This flaw allows a remote attacker to send specially crafted TCP streams with 'keep-response-order' enabled that could cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period, even after the client has terminated the connection. This issue results in BIND consuming resources, leading to a denial of service.
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||2068487, 2068488, 2068478|
Description TEJ RATHI 2022-03-16 04:42:11 UTC
ISC recently discovered an issue in BIND that allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This issue is present in BIND 9.16.11 to 9.16.26 (including S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep-response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block, and as such, any hosts specified within it will be able to trigger this issue on affected.
Comment 1 Petr Menšík 2022-03-17 10:35:00 UTC
bind package in RHEL9 and bind9.16 package in RHEL8 is affected. Of course also Fedora 34-37 is affected too