Bug 1679299 (CVE-2018-5744) - CVE-2018-5744 bind: A specially crafted packet can cause named to leak memory
Summary: CVE-2018-5744 bind: A specially crafted packet can cause named to leak memory
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-5744
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1679925 1679926 1680514
Blocks: 1679305
TreeView+ depends on / blocked
 
Reported: 2019-02-20 20:37 UTC by Pedro Sampaio
Modified: 2022-03-13 17:01 UTC (History)
17 users (show)

Fixed In Version: bind 9.11.5-P4, bind 9.12.3-P4
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way bind failed to free memory when processing certain messages. An attacker could use this flaw to cause a denial of service via memory exhaustion, by send specially crafted messages with Extension mechanisms for DNS (EDNS) options.
Clone Of:
Environment:
Last Closed: 2019-02-27 07:24:01 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2019-02-20 20:37:45 UTC 
A flaw was found in Bind. A failure to free memory can occur when processing messages having a specific combination of EDNS options, causing named's memory use to grow without bounds until all memory is exhausted.
Comment 1 Andrej Nemec 2019-02-22 08:58:11 UTC 
External References:

https://kb.isc.org/docs/cve-2018-5744
Comment 2 Andrej Nemec 2019-02-22 09:01:08 UTC 
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1679925]


Created bind99 tracking bugs for this issue:

Affects: fedora-all [bug 1679926]
Comment 3 Petr Menšík 2019-02-22 17:54:46 UTC 
Ok, Fedora bugs are already prepared, it is public. Patches apply well to 9.11 bind in RHEL8. Where are bugs for RHEL?
Comment 5 Tomas Hoger 2019-02-25 09:04:52 UTC 
Upstream advisory notes the following versions as being affected by this issue:

9.10.7 -> 9.10.8-P1
9.11.3 -> 9.11.5-P1
9.12.0 -> 9.12.3-P1
9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition
9.13.0 -> 9.13.6 of the 9.13 development branch

The versions of bind as shipped in Red Hat Enterprise Linux are based on older upstream versions - 9.9.4 for Red Hat Enterprise Linux 7 and 9.8.2 for Red Hat Enterprise Linux 6.
Comment 6 Tomas Hoger 2019-02-25 09:10:26 UTC 
Related upstream commits (on 9.11 branch):

https://gitlab.isc.org/isc-projects/bind9/commit/d5243a5231c0fe11cfb29e0cf1eb3d34d6ff15ea
https://gitlab.isc.org/isc-projects/bind9/commit/2bda5ac2e1635ac10a595c4ff155516ded7abec2
https://gitlab.isc.org/isc-projects/bind9/commit/bf6b47799419dd26968c4dbfd195ad339bf4c675
Comment 7 Tomas Hoger 2019-02-25 09:14:23 UTC 
The patch changes the code introduced in the following commit:

https://gitlab.isc.org/isc-projects/bind9/commit/1c8aa38b53a0494fc7d4c3439594d1913987f264

This functionality was introduced in upstream versions 9.11.3 and 9.10.7:

https://gitlab.isc.org/isc-projects/bind9/blob/v9_11_3/CHANGES#L332-335
https://gitlab.isc.org/isc-projects/bind9/blob/v9_10_7/CHANGES#L268-271

which matches the list of affected versions as noted in comment 5 above.  This functionality does not exist in the bind packages in Red Hat Enterprise Linux 7 and earlier.
Comment 8 Tomas Hoger 2019-02-25 09:15:28 UTC 
Acknowledgments:

Name: ISC
Comment 14 Eric Christensen 2019-02-27 15:49:27 UTC 
Statement:

Versions of bind package shipped with Red Hat Enterprise Linux 5, 6, and 7 did not ship the vulnerable code and therefore are not affected by this flaw. For more details please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1679299#c7
Note You need to log in before you can comment on or make changes to this bug.