Bug 1702541 (CVE-2018-5743) - CVE-2018-5743 bind: Limiting simultaneous TCP clients is ineffective
Summary: CVE-2018-5743 bind: Limiting simultaneous TCP clients is ineffective
Status: CLOSED ERRATA
Alias: CVE-2018-5743
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20190424,repo...
Keywords: Reopened, Security
Depends On: 1702556 1702558 1702554 1702555 1702557 1702881 1702882
Blocks: 1702542
TreeView+ depends on / blocked
 
Reported: 2019-04-24 05:29 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-07-12 13:07 UTC (History)
15 users (show)

(edit)
A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files. In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system.
Clone Of:
(edit)
Last Closed: 2019-07-12 13:07:03 UTC


Attachments (Terms of Use)
bind patch against 9.11.6 (27.25 KB, patch)
2019-04-24 06:15 UTC, Huzaifa S. Sidhpurwala
no flags Details | Diff
patch for 9.12.4 (26.36 KB, patch)
2019-04-24 06:15 UTC, Huzaifa S. Sidhpurwala
no flags Details | Diff
patch for 9.14.1 (26.64 KB, patch)
2019-04-24 06:16 UTC, Huzaifa S. Sidhpurwala
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:1434 None None None 2019-06-11 09:54 UTC
Red Hat Product Errata RHBA-2019:1550 None None None 2019-06-19 17:39 UTC
Red Hat Product Errata RHBA-2019:1625 None None None 2019-06-27 13:23 UTC
Red Hat Product Errata RHSA-2019:1145 None None None 2019-05-13 05:04 UTC
Red Hat Product Errata RHSA-2019:1294 None None None 2019-05-29 18:08 UTC
Red Hat Product Errata RHSA-2019:1492 None None None 2019-06-17 12:48 UTC

Description Huzaifa S. Sidhpurwala 2019-04-24 05:29:40 UTC
As per upstream advisory:

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contains an error which can be exploited to grow the number of simultaneous connections beyond this limit.

By exploiting the failure to limit simultaneous TCP connections,an attacker can deliberately exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files.

In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system.

Comment 1 Huzaifa S. Sidhpurwala 2019-04-24 05:29:42 UTC
Acknowledgments:

Name: ISC
Upstream: AT&T

Comment 2 Huzaifa S. Sidhpurwala 2019-04-24 06:15 UTC
Created attachment 1557974 [details]
bind patch against 9.11.6

Comment 3 Huzaifa S. Sidhpurwala 2019-04-24 06:15 UTC
Created attachment 1557975 [details]
patch for 9.12.4

Comment 4 Huzaifa S. Sidhpurwala 2019-04-24 06:16 UTC
Created attachment 1557976 [details]
patch for 9.14.1

Comment 10 Huzaifa S. Sidhpurwala 2019-04-25 05:22:57 UTC
External References:

https://kb.isc.org/docs/cve-2018-5743

Comment 11 Huzaifa S. Sidhpurwala 2019-04-25 05:23:15 UTC
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1702881]


Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1702882]

Comment 13 Petr Menšík 2019-05-07 14:02:51 UTC
Useful resource explaining how this CVE fix works and how is different from previous versions, is available on upstream KB[1].

1. https://kb.isc.org/docs/how-does-tcp-clients-work

Comment 15 errata-xmlrpc 2019-05-13 05:04:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1145 https://access.redhat.com/errata/RHSA-2019:1145

Comment 17 errata-xmlrpc 2019-05-29 18:08:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1294 https://access.redhat.com/errata/RHSA-2019:1294

Comment 23 errata-xmlrpc 2019-06-17 12:48:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:1492 https://access.redhat.com/errata/RHSA-2019:1492

Comment 24 Huzaifa S. Sidhpurwala 2019-06-19 04:47:31 UTC
Statement:

This bind flaw can be exploited by a remote attacker (AV:N) by opening large number of  simultaneous TCP client connections with the server. No special exploit code is required apart from the ability to open large number of TCP connections simultaneously either from one attacker machine or via some distributed attacker network (AC:L and PR:L). No user interaction is required from the server side (UI:N). The attacker can cause denial of service (A:H) by exhausting the file descriptor pool which named has access to. Also in cases where named process is not limited by OS-enforced per-process limits, this could cause exhaustion of available free file descriptors on the system running the named server causing denial of service for other processes running on that machine (S:C).

Comment 25 Product Security DevOps Team 2019-07-12 13:07:03 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-5743


Note You need to log in before you can comment on or make changes to this bug.