As per upstream advisory: By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contains an error which can be exploited to grow the number of simultaneous connections beyond this limit. By exploiting the failure to limit simultaneous TCP connections,an attacker can deliberately exhaust the pool of file descriptors available to named, potentially affecting network connections and the management of files such as log files or zone journal files. In cases where the named process is not limited by OS-enforced per-process limits, this could additionally potentially lead to exhaustion of all available free file descriptors on that system.
Acknowledgments: Name: ISC Upstream: AT&T
Created attachment 1557974 [details] bind patch against 9.11.6
Created attachment 1557975 [details] patch for 9.12.4
Created attachment 1557976 [details] patch for 9.14.1
External References: https://kb.isc.org/docs/cve-2018-5743
Created bind tracking bugs for this issue: Affects: fedora-all [bug 1702881] Created bind99 tracking bugs for this issue: Affects: fedora-all [bug 1702882]
Useful resource explaining how this CVE fix works and how is different from previous versions, is available on upstream KB[1]. 1. https://kb.isc.org/docs/how-does-tcp-clients-work
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:1145 https://access.redhat.com/errata/RHSA-2019:1145
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:1294 https://access.redhat.com/errata/RHSA-2019:1294
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:1492 https://access.redhat.com/errata/RHSA-2019:1492
Statement: This bind flaw can be exploited by a remote attacker (AV:N) by opening large number of simultaneous TCP client connections with the server. No special exploit code is required apart from the ability to open large number of TCP connections simultaneously either from one attacker machine or via some distributed attacker network (AC:L and PR:L). No user interaction is required from the server side (UI:N). The attacker can cause denial of service (A:H) by exhausting the file descriptor pool which named has access to. Also in cases where named process is not limited by OS-enforced per-process limits, this could cause exhaustion of available free file descriptors on the system running the named server causing denial of service for other processes running on that machine (S:C).
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-5743
Release notes mentioning CVE-2018-5743 fix: Experimental development branch 9.15.3: https://downloads.isc.org/isc/bind9/9.15.3/RELEASE-NOTES-bind-9.15.3.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Extended Update Support Via RHSA-2019:2698 https://access.redhat.com/errata/RHSA-2019:2698
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2019:2977 https://access.redhat.com/errata/RHSA-2019:2977