Bug 2064515 (CVE-2022-0667)

Summary: CVE-2022-0667 bind: When chasing DS records, a timed-out or artificially delayed fetch could cause 'named' to crash while resuming a DS lookup
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anon.amish, dns-sig, jorton, mosvald, mruprich, pavel, pemensik, security-response-team, vonsch, yozone, zdohnal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: bind 9.18.1 Doc Type: If docs needed, set a value
Doc Text:
An assertion check flaw was found in BIND, with a refactoration of recursive client code that introduced a "backstop lifetime timer." While BIND processes a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. As a result of this timeout, the resume_dslookup() function is called, which does not test whether the fetch has shut down previously. This issue triggers an assertion failure, which could cause the BIND process to terminate.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2022-04-06 11:27:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2064517    

Description TEJ RATHI 2022-03-16 04:42:17 UTC 
In BIND 9.18.0 the recursive client code was refactored. This refactoring introduced a "backstop lifetime timer."

While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate.

Only the BIND 9.18 branch is affected.
Comment 1 Petr Menšík 2022-03-17 10:41:30 UTC 
BIND 9.18.0 were not yet released even on Fedora Rawhide, because bind-dyndb-ldap part of freeipa would be broken by that. It should be part of Fedora 37 starting with 9.18.1, where this issue would be fixed. Bug #2057493 is used as readiness tracker.
Comment 4 Product Security DevOps Team 2022-04-06 11:27:30 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0667