CVE-2022-2795 (GCVE-0-2022-2795)

Vulnerability from cvelistv5 – Published: 2022-09-21 10:15 – Updated: 2024-11-29 12:04
VLAI?
Title
Processing large delegations may severely degrade resolver performance
Summary
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • In BIND 9.0.0 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.9.3-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a flaw in resolver code can cause named to spend excessive amounts of time on processing large delegations.
Assigner
isc
References
Impacted products
Vendor Product Version
ISC BIND9 Affected: Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33
Affected: Open Source Branch 9.18 9.18.0 through versions before 9.18.7
Affected: Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1
Affected: Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1
Affected: Development Branch 9.19 9.19.0 through versions before 9.19.5
Create a notification for this product.
Credits
ISC would like to thank Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr & Shani Stajnrod from Reichman University for bringing this vulnerability to our attention.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:isc:bind:9.0.0:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bind",
            "vendor": "isc",
            "versions": [
              {
                "lessThanOrEqual": "9.16.32",
                "status": "affected",
                "version": "9.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bind",
            "vendor": "isc",
            "versions": [
              {
                "lessThan": "9.11.37",
                "status": "affected",
                "version": "9.9.3",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bind",
            "vendor": "isc",
            "versions": [
              {
                "lessThan": "9.16.32",
                "status": "affected",
                "version": "9.16.8",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bind",
            "vendor": "isc",
            "versions": [
              {
                "lessThan": "9.19.4",
                "status": "affected",
                "version": "9.19.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-12T17:20:53.564264Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T19:41:53.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-29T12:04:33.614Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.isc.org/docs/cve-2022-2795"
          },
          {
            "name": "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/09/21/3"
          },
          {
            "name": "DSA-5235",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5235"
          },
          {
            "name": "FEDORA-2022-ef038365de",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/"
          },
          {
            "name": "FEDORA-2022-8268735e06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/"
          },
          {
            "name": "FEDORA-2022-b197d64471",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/"
          },
          {
            "name": "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html"
          },
          {
            "name": "GLSA-202210-25",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-25"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241129-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIND9",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33"
            },
            {
              "status": "affected",
              "version": "Open Source Branch 9.18 9.18.0 through versions before 9.18.7"
            },
            {
              "status": "affected",
              "version": "Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1"
            },
            {
              "status": "affected",
              "version": "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1"
            },
            {
              "status": "affected",
              "version": "Development Branch 9.19 9.19.0 through versions before 9.19.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ISC would like to thank Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr \u0026 Shani Stajnrod from Reichman University for bringing this vulnerability to our attention."
        }
      ],
      "datePublic": "2022-09-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver\u0027s performance, effectively denying legitimate clients access to the DNS resolution service."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "We are not aware of any active exploits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "In BIND 9.0.0 -\u003e 9.16.32, 9.18.0 -\u003e 9.18.6, versions 9.9.3-S1 -\u003e 9.11.37-S1, 9.16.8-S1 -\u003e 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -\u003e 9.19.4 of the BIND 9.19 development branch, a flaw in resolver code can cause named to spend excessive amounts of time on processing large delegations.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-31T00:00:00",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "url": "https://kb.isc.org/docs/cve-2022-2795"
        },
        {
          "name": "[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/09/21/3"
        },
        {
          "name": "DSA-5235",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5235"
        },
        {
          "name": "FEDORA-2022-ef038365de",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/"
        },
        {
          "name": "FEDORA-2022-8268735e06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/"
        },
        {
          "name": "FEDORA-2022-b197d64471",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/"
        },
        {
          "name": "[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html"
        },
        {
          "name": "GLSA-202210-25",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-25"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Processing large delegations may severely degrade resolver performance",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workarounds known."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2022-2795",
    "datePublished": "2022-09-21T10:15:25.796304Z",
    "dateReserved": "2022-08-12T00:00:00",
    "dateUpdated": "2024-11-29T12:04:33.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://kb.isc.org/docs/cve-2022-2795\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2022/09/21/3\", \"name\": \"[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2022/dsa-5235\", \"name\": \"DSA-5235\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/\", \"name\": \"FEDORA-2022-ef038365de\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/\", \"name\": \"FEDORA-2022-8268735e06\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/\", \"name\": \"FEDORA-2022-b197d64471\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html\", \"name\": \"[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202210-25\", \"name\": \"GLSA-202210-25\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20241129-0002/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-11-29T12:04:33.614Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-2795\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-12T17:20:53.564264Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:isc:bind:9.0.0:-:*:*:*:*:*:*\"], \"vendor\": \"isc\", \"product\": \"bind\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"9.16.32\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*\"], \"vendor\": \"isc\", \"product\": \"bind\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.9.3\", \"lessThan\": \"9.11.37\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:isc:bind:9.16.8:s1:*:*:*:*:*:*\"], \"vendor\": \"isc\", \"product\": \"bind\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.16.8\", \"lessThan\": \"9.16.32\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:isc:bind:9.19.0:*:*:*:-:*:*:*\"], \"vendor\": \"isc\", \"product\": \"bind\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.19.0\", \"lessThan\": \"9.19.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-20T19:41:49.408Z\"}}], \"cna\": {\"title\": \"Processing large delegations may severely degrade resolver performance\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"ISC would like to thank Yehuda Afek from Tel-Aviv University and Anat Bremler-Barr \u0026 Shani Stajnrod from Reichman University for bringing this vulnerability to our attention.\"}], \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"ISC\", \"product\": \"BIND9\", \"versions\": [{\"status\": \"affected\", \"version\": \"Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33\"}, {\"status\": \"affected\", \"version\": \"Open Source Branch 9.18 9.18.0 through versions before 9.18.7\"}, {\"status\": \"affected\", \"version\": \"Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1\"}, {\"status\": \"affected\", \"version\": \"Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1\"}, {\"status\": \"affected\", \"version\": \"Development Branch 9.19 9.19.0 through versions before 9.19.5\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"We are not aware of any active exploits.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.\"}], \"datePublic\": \"2022-09-21T00:00:00\", \"references\": [{\"url\": \"https://kb.isc.org/docs/cve-2022-2795\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2022/09/21/3\", \"name\": \"[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.debian.org/security/2022/dsa-5235\", \"name\": \"DSA-5235\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/\", \"name\": \"FEDORA-2022-ef038365de\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/\", \"name\": \"FEDORA-2022-8268735e06\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/\", \"name\": \"FEDORA-2022-b197d64471\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html\", \"name\": \"[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://security.gentoo.org/glsa/202210-25\", \"name\": \"GLSA-202210-25\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"No workarounds known.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver\u0027s performance, effectively denying legitimate clients access to the DNS resolution service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"In BIND 9.0.0 -\u003e 9.16.32, 9.18.0 -\u003e 9.18.6, versions 9.9.3-S1 -\u003e 9.11.37-S1, 9.16.8-S1 -\u003e 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -\u003e 9.19.4 of the BIND 9.19 development branch, a flaw in resolver code can cause named to spend excessive amounts of time on processing large delegations.\"}]}], \"providerMetadata\": {\"orgId\": \"404fd4d2-a609-4245-b543-2c944a302a22\", \"shortName\": \"isc\", \"dateUpdated\": \"2022-10-31T00:00:00\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-2795\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-29T12:04:33.614Z\", \"dateReserved\": \"2022-08-12T00:00:00\", \"assignerOrgId\": \"404fd4d2-a609-4245-b543-2c944a302a22\", \"datePublished\": \"2022-09-21T10:15:25.796304Z\", \"assignerShortName\": \"isc\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.