Vulnerability · Published Oct 27, 2021 · Assigned by isc
CVE-2021-25219Lame cache can be abused to severely degrade resolver performance
Medium 5.3
In plain English
A medium-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.2% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bind | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-chroot | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-devel | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-export-devel | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-export-libs | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-libs | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-libs-lite | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-license | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-lite-devel | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-pkcs11 | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-pkcs11-devel | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-pkcs11-libs | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-pkcs11-utils | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-sdb | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-sdb-chroot | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | bind-utils | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| AlmaLinux:8 | python3-bind | 32:9.11.36-3.el8 | ALSA-2022:2092 |
| Alpine:v3.20 | bind | 9.16.22-r0 | ALPINE-CVE-2021-25219 |
| Alpine:v3.21 | bind | 9.16.22-r0 | ALPINE-CVE-2021-25219 |
| Alpine:v3.22 | bind | 9.16.22-r0 | ALPINE-CVE-2021-25219 |
| Alpine:v3.23 | bind | 9.16.22-r0 | ALPINE-CVE-2021-25219 |
| Alpine:v3.24 | bind | 9.16.22-r0 | ALPINE-CVE-2021-25219 |
| Debian:12 | bind9 | 1:9.17.19-1 | DEBIAN-CVE-2021-25219 |
| Debian:13 | bind9 | 1:9.17.19-1 | DEBIAN-CVE-2021-25219 |
| Debian:14 | bind9 | 1:9.17.19-1 | DEBIAN-CVE-2021-25219 |
| Rocky Linux:8 | bind | 2:9.11.36-3.el8 | RLSA-2022:2092 |
| Ubuntu:22.04:LTS | bind9 | 1:9.16.15-1ubuntu2 | UBUNTU-CVE-2021-25219 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ISC | BIND9 | Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.22-S1Development Branch 9.17 9.17.0 through versions before 9.17.19 |
References
- https://kb.isc.org/v1/docs/cve-2021-25219
- DSA-4994 vendor-advisory
- [debian-lts-announce] 20211102 [SECURITY] [DLA 2807-1] bind9 security update mailing-list
- FEDORA-2021-58e7b873b7 vendor-advisory
- FEDORA-2021-39b33260b8 vendor-advisory
- FEDORA-2021-eb8dab50ba vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://security.netapp.com/advisory/ntap-20211118-0002/
- GLSA-202210-25 vendor-advisory