Vulnerability · Published Jul 23, 2024 · Assigned by isc
CVE-2024-0760A flood of DNS messages over TCP may make the server unstable
High 7.5
In plain English
A high-severity resource allocation without limits in BIND 9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | bind | 9.18.31-r0 | ALPINE-CVE-2024-0760 |
| Alpine:v3.21 | bind | 9.18.28-r0 | ALPINE-CVE-2024-0760 |
| Alpine:v3.22 | bind | 9.18.28-r0 | ALPINE-CVE-2024-0760 |
| Alpine:v3.23 | bind | 9.18.28-r0 | ALPINE-CVE-2024-0760 |
| Alpine:v3.24 | bind | 9.18.28-r0 | ALPINE-CVE-2024-0760 |
| Debian:12 | bind9 | 1:9.18.28-1~deb12u1 | DEBIAN-CVE-2024-0760 |
| Debian:13 | bind9 | 1:9.20.0-1 | DEBIAN-CVE-2024-0760 |
| Debian:14 | bind9 | 1:9.20.0-1 | DEBIAN-CVE-2024-0760 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.28-0ubuntu0.22.04.1 | USN-6909-1 |
| Ubuntu:22.04:LTS | bind9 | 1:9.18.28-0ubuntu0.22.04.1 | UBUNTU-CVE-2024-0760 |
| Ubuntu:24.04:LTS | bind9 | 1:9.18.28-0ubuntu0.24.04.1 | UBUNTU-CVE-2024-0760 |
| Ubuntu:24.04:LTS | bind9 | 1:9.18.28-0ubuntu0.24.04.1 | USN-6909-1 |
| Ubuntu:22.04:LTS | bind9-libs | no fix listed | UBUNTU-CVE-2024-0760 |
| Ubuntu:24.04:LTS | isc-dhcp | no fix listed | UBUNTU-CVE-2024-0760 |
| Ubuntu:25.10 | isc-dhcp | no fix listed | UBUNTU-CVE-2024-0760 |
| Ubuntu:26.04:LTS | isc-dhcp | no fix listed | UBUNTU-CVE-2024-0760 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H