Bug 1953849 (CVE-2021-25214) - CVE-2021-25214 bind: Broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly
Summary: CVE-2021-25214 bind: Broken inbound incremental zone update (IXFR) can cause ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-25214
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1953853 1953854 1953855 1954897
Blocks: 1953850
TreeView+ depends on / blocked
 
Reported: 2021-04-27 05:55 UTC by Huzaifa S. Sidhpurwala
Modified: 2022-04-17 21:19 UTC (History)
12 users (show)

Fixed In Version: bind 9.11.30, bind 9.16.14, bind 9.17.12
Doc Type: If docs needed, set a value
Doc Text:
Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the next SOA refresh query for that zone is made.
Clone Of:
Environment:
Last Closed: 2021-08-31 18:56:10 UTC

Attachments (Terms of Use)
Patch against 9.11 (781 bytes, patch)
2021-04-27 06:19 UTC, Huzaifa S. Sidhpurwala 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3325 0 None None None 2021-08-31 09:07:56 UTC
Red Hat Product Errata RHSA-2021:4384 0 None None None 2021-11-09 18:32:37 UTC

Description Huzaifa S. Sidhpurwala 2021-04-27 05:55:30 UTC 
As per upstream advisory:

Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the next SOA refresh query for that zone is made.
Comment 1 Huzaifa S. Sidhpurwala 2021-04-27 05:55:34 UTC 
Mitigation:

Disabling incremental zone transfers (IXFR) by setting "request-ixfr no;" in the desired configuration block (options, zone, or server) prevents the failing assertion from being evaluated.
Comment 2 Huzaifa S. Sidhpurwala 2021-04-27 05:56:37 UTC 
Acknowledgments:

Name: ISC
Upstream: Greg Kuechle (SaskTel)
Comment 4 Huzaifa S. Sidhpurwala 2021-04-27 06:19:50 UTC 
Created attachment 1775847 [details]
Patch against 9.11
Comment 5 Huzaifa S. Sidhpurwala 2021-04-29 03:26:20 UTC 
External References:

https://kb.isc.org/docs/cve-2021-25214
Comment 6 Huzaifa S. Sidhpurwala 2021-04-29 03:27:01 UTC 
Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1954897]
Comment 7 errata-xmlrpc 2021-08-31 09:07:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:3325 https://access.redhat.com/errata/RHSA-2021:3325
Comment 8 Product Security DevOps Team 2021-08-31 18:56:10 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-25214
Comment 9 errata-xmlrpc 2021-11-09 18:32:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4384 https://access.redhat.com/errata/RHSA-2021:4384
Note You need to log in before you can comment on or make changes to this bug.