Bug 2298901 (CVE-2024-1975) - CVE-2024-1975 bind9: bind: SIG(0) can be used to exhaust CPU resources [NEEDINFO]
Summary: CVE-2024-1975 bind9: bind: SIG(0) can be used to exhaust CPU resources
Keywords:
Status: NEW
Alias: CVE-2024-1975
Deadline: 2024-07-23
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-19 18:37 UTC by Marco Benatto
Modified: 2024-09-18 03:07 UTC (History)
20 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the bind9 package, where if a DNS server hosts a zone containing a "KEY" resource record or a DNS resolver utilizes the DNSSEC validate feature to validate a "KEY" resource record, a malicious client could exhaust the CPU resourced from the resolver by sending a stream of SIG(0) signed requests. This issue can lead to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:
sagopina: needinfo? (prodsec-dev)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:5704 0 None None None 2024-08-21 12:22:45 UTC
Red Hat Product Errata RHBA-2024:5855 0 None None None 2024-08-26 11:05:36 UTC
Red Hat Product Errata RHBA-2024:5887 0 None None None 2024-08-27 09:11:48 UTC
Red Hat Product Errata RHBA-2024:5909 0 None None None 2024-08-27 20:25:30 UTC
Red Hat Product Errata RHBA-2024:5931 0 None None None 2024-08-28 11:49:45 UTC
Red Hat Product Errata RHSA-2024:5231 0 None None None 2024-08-12 13:40:54 UTC
Red Hat Product Errata RHSA-2024:5390 0 None None None 2024-08-14 11:43:10 UTC
Red Hat Product Errata RHSA-2024:5418 0 None None None 2024-08-15 01:52:58 UTC
Red Hat Product Errata RHSA-2024:5524 0 None None None 2024-08-19 06:50:09 UTC
Red Hat Product Errata RHSA-2024:5525 0 None None None 2024-08-19 05:59:47 UTC
Red Hat Product Errata RHSA-2024:5655 0 None None None 2024-08-20 18:13:43 UTC
Red Hat Product Errata RHSA-2024:5813 0 None None None 2024-08-26 08:05:32 UTC
Red Hat Product Errata RHSA-2024:5838 0 None None None 2024-08-26 08:12:02 UTC
Red Hat Product Errata RHSA-2024:5871 0 None None None 2024-08-26 18:11:15 UTC
Red Hat Product Errata RHSA-2024:5894 0 None None None 2024-08-27 11:24:58 UTC
Red Hat Product Errata RHSA-2024:5907 0 None None None 2024-08-27 18:20:52 UTC
Red Hat Product Errata RHSA-2024:5908 0 None None None 2024-08-27 18:40:52 UTC
Red Hat Product Errata RHSA-2024:5930 0 None None None 2024-08-28 11:31:19 UTC
Red Hat Product Errata RHSA-2024:6004 0 None None None 2024-09-03 19:14:45 UTC
Red Hat Product Errata RHSA-2024:6009 0 None None None 2024-09-04 07:57:15 UTC
Red Hat Product Errata RHSA-2024:6013 0 None None None 2024-09-05 05:56:50 UTC
Red Hat Product Errata RHSA-2024:6406 0 None None None 2024-09-11 18:34:55 UTC
Red Hat Product Errata RHSA-2024:6642 0 None None None 2024-09-18 03:07:26 UTC

Description Marco Benatto 2024-07-19 18:37:46 UTC 
If a server hosts a zone containing a “KEY” Resource Record, or a resolver DNSSEC-validates a “KEY” Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.

This vulnerability affects the following upstream's bind9 versions:
9.0.0 -> 9.11.37
9.16.0 -> 9.16.50
9.18.0 -> 9.18.27
9.19.0 -> 9.19.24
Comment 2 errata-xmlrpc 2024-08-12 13:40:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:5231 https://access.redhat.com/errata/RHSA-2024:5231
Comment 3 errata-xmlrpc 2024-08-14 11:43:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5390 https://access.redhat.com/errata/RHSA-2024:5390
Comment 4 errata-xmlrpc 2024-08-15 01:52:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:5418 https://access.redhat.com/errata/RHSA-2024:5418
Comment 5 errata-xmlrpc 2024-08-19 05:59:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5525 https://access.redhat.com/errata/RHSA-2024:5525
Comment 6 errata-xmlrpc 2024-08-19 06:50:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5524 https://access.redhat.com/errata/RHSA-2024:5524
Comment 8 errata-xmlrpc 2024-08-20 18:13:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:5655 https://access.redhat.com/errata/RHSA-2024:5655
Comment 9 errata-xmlrpc 2024-08-26 08:05:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:5813 https://access.redhat.com/errata/RHSA-2024:5813
Comment 10 errata-xmlrpc 2024-08-26 08:11:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5838 https://access.redhat.com/errata/RHSA-2024:5838
Comment 11 errata-xmlrpc 2024-08-26 18:11:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:5871 https://access.redhat.com/errata/RHSA-2024:5871
Comment 12 errata-xmlrpc 2024-08-27 11:24:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:5894 https://access.redhat.com/errata/RHSA-2024:5894
Comment 13 errata-xmlrpc 2024-08-27 18:20:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:5907 https://access.redhat.com/errata/RHSA-2024:5907
Comment 14 errata-xmlrpc 2024-08-27 18:40:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:5908 https://access.redhat.com/errata/RHSA-2024:5908
Comment 15 errata-xmlrpc 2024-08-28 11:31:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2024:5930 https://access.redhat.com/errata/RHSA-2024:5930
Comment 16 errata-xmlrpc 2024-09-03 19:14:42 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:6004 https://access.redhat.com/errata/RHSA-2024:6004
Comment 17 errata-xmlrpc 2024-09-04 07:57:13 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2024:6009 https://access.redhat.com/errata/RHSA-2024:6009
Comment 18 errata-xmlrpc 2024-09-05 05:56:48 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2024:6013 https://access.redhat.com/errata/RHSA-2024:6013
Comment 19 errata-xmlrpc 2024-09-11 18:34:52 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2024:6406 https://access.redhat.com/errata/RHSA-2024:6406
Comment 20 errata-xmlrpc 2024-09-18 03:07:24 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2024:6642 https://access.redhat.com/errata/RHSA-2024:6642
Note You need to log in before you can comment on or make changes to this bug.