Log in Start free

Vulnerability · Published Sep 20, 2023 · Assigned by isc

CVE-2023-4236named may terminate unexpectedly under high DNS-over-TLS query load

High 7.5

In plain English

A high-severity security flaw in BIND 9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.2%top 17.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20bind9.18.19-r0ALPINE-CVE-2023-4236
Alpine:v3.21bind9.18.19-r0ALPINE-CVE-2023-4236
Alpine:v3.22bind9.18.19-r0ALPINE-CVE-2023-4236
Alpine:v3.23bind9.18.19-r0ALPINE-CVE-2023-4236
Alpine:v3.24bind9.18.19-r0ALPINE-CVE-2023-4236
Debian:12bind91:9.18.19-1~deb12u1DEBIAN-CVE-2023-4236
Debian:13bind91:9.19.17-1DEBIAN-CVE-2023-4236
Debian:14bind91:9.19.17-1DEBIAN-CVE-2023-4236
Ubuntu:22.04:LTSbind91:9.18.12-0ubuntu0.22.04.3USN-6390-1
Ubuntu:22.04:LTSbind91:9.18.12-0ubuntu0.22.04.3UBUNTU-CVE-2023-4236
Ubuntu:24.04:LTSbind91:9.18.18-0ubuntu2UBUNTU-CVE-2023-4236

Affected products (as reported)

VendorProductVersions
ISC BIND 9 9.18.0 – through 9.18.189.18.11-S1 – through 9.18.18-S1

References