Log in Start free

Vulnerability · Published Sep 21, 2022 · Assigned by isc

CVE-2022-3080BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

High 7.5

In plain English

A high-severity security flaw in BIND9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.0%top 19.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

By sending specific queries to the resolver, an attacker can cause named to crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9bind32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-chroot32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-devel32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-dnssec-doc32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-dnssec-utils32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-libs32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-license32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:9bind-utils32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:8bind9.1632:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-chroot32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-devel32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-dnssec-utils32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-doc32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-libs32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-license32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:8bind9.16-utils32:9.16.23-0.7.el8_6.1ALSA-2022:6781
AlmaLinux:9python3-bind32:9.16.23-1.el9_0.1ALSA-2022:6763
AlmaLinux:8python3-bind9.1632:9.16.23-0.7.el8_6.1ALSA-2022:6781
Alpine:v3.20bind9.18.7-r0ALPINE-CVE-2022-3080
Alpine:v3.21bind9.18.7-r0ALPINE-CVE-2022-3080
Alpine:v3.22bind9.18.7-r0ALPINE-CVE-2022-3080
Alpine:v3.23bind9.18.7-r0ALPINE-CVE-2022-3080
Alpine:v3.24bind9.18.7-r0ALPINE-CVE-2022-3080
Debian:12bind91:9.18.7-1DEBIAN-CVE-2022-3080
Debian:13bind91:9.18.7-1DEBIAN-CVE-2022-3080
Debian:14bind91:9.18.7-1DEBIAN-CVE-2022-3080
Rocky Linux:9bind2:9.16.23-1.el9_0.1RLSA-2022:6763
Rocky Linux:8bind9.162:9.16.23-0.7.el8_6.1RLSA-2022:6781
Ubuntu:22.04:LTSbind91:9.18.1-1ubuntu1.2UBUNTU-CVE-2022-3080
Ubuntu:22.04:LTSbind91:9.18.1-1ubuntu1.2USN-5626-1

Affected products (as reported)

VendorProductVersions
ISC BIND9 Open Source Branch 9.16 9.16.14 through versions before 9.16.33Open Source Branch 9.18 9.18.0 through versions before 9.18.7Supported Preview Branch 9.16-S 9.16.14-S1 through versions before 9.16.33-S1Development Branch 9.19 9.19.0 through versions before 9.19.5

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References