|Summary:||CVE-2022-0667 bind: When chasing DS records, a timed-out or artificially delayed fetch could cause 'named' to crash while resuming a DS lookup|
|Product:||[Other] Security Response||Reporter:||TEJ RATHI <trathi>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED NOTABUG||QA Contact:|
|Version:||unspecified||CC:||anon.amish, dns-sig, jorton, mosvald, mruprich, pavel, pemensik, security-response-team, vonsch, yozone, zdohnal|
|Fixed In Version:||bind 9.18.1||Doc Type:||If docs needed, set a value|
An assertion check flaw was found in BIND, with a refactoration of recursive client code that introduced a "backstop lifetime timer." While BIND processes a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. As a result of this timeout, the resume_dslookup() function is called, which does not test whether the fetch has shut down previously. This issue triggers an assertion failure, which could cause the BIND process to terminate.
|Last Closed:||2022-04-06 11:27:32 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:|
Description TEJ RATHI 2022-03-16 04:42:17 UTC
In BIND 9.18.0 the recursive client code was refactored. This refactoring introduced a "backstop lifetime timer." While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate. Only the BIND 9.18 branch is affected.
Comment 1 Petr Menšík 2022-03-17 10:41:30 UTC
BIND 9.18.0 were not yet released even on Fedora Rawhide, because bind-dyndb-ldap part of freeipa would be broken by that. It should be part of Fedora 37 starting with 9.18.1, where this issue would be fixed. Bug #2057493 is used as readiness tracker.
Comment 4 Product Security DevOps Team 2022-04-06 11:27:30 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0667