CVE-2021-25219 Lame cache can be abused to severely degrade resolver performance
MediumCVSS 5.3
EPSS 11.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bind9(Debian:12) | < 1:9.17.19-1 | 1:9.17.19-1 |
| debian/bind9(Debian:13) | < 1:9.17.19-1 | 1:9.17.19-1 |
| debian/bind9(Debian:14) | < 1:9.17.19-1 | 1:9.17.19-1 |
| ubuntu/bind9(Ubuntu:22.04) | < 1:9.16.15-1ubuntu2 | 1:9.16.15-1ubuntu2 |
| isc bind | >= 9.3.0, < 9.11.36 | 9.11.36 |
| isc bind | >= 9.12.0, < 9.16.22 | 9.16.22 |
| isc bind | >= 9.17.0, < 9.17.19 | 9.17.19 |
| isc bind | = 9.9.3-s1 | No fix listed |
| isc bind | = 9.9.12-s1 | No fix listed |
| isc bind | = 9.9.13-s1 | No fix listed |
| isc bind | = 9.10.5-s1 | No fix listed |
| isc bind | = 9.10.7-s1 | No fix listed |
| isc bind | = 9.11.3-s1 | No fix listed |
| isc bind | = 9.11.5-s3 | No fix listed |
| isc bind | = 9.11.5-s5 | No fix listed |
| isc bind | = 9.11.5-s6 | No fix listed |
| isc bind | = 9.11.6-s1 | No fix listed |
| isc bind | = 9.11.7-s1 | No fix listed |
| isc bind | = 9.11.8-s1 | No fix listed |
| isc bind | = 9.11.12-s1 | No fix listed |
| isc bind | = 9.11.21-s1 | No fix listed |
| isc bind | = 9.11.27-s1 | No fix listed |
| isc bind | = 9.11.29-s1 | No fix listed |
| isc bind | = 9.11.35-s1 | No fix listed |
| isc bind | = 9.16.8-s1 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| isc bind | = 9.16.11-s1 | No fix listed |
| isc bind | = 9.16.13-s1 | No fix listed |
| isc bind | = 9.16.21-s1 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| debian linux | = 11.0 | No fix listed |
| fedoraproject fedora | = 33 | No fix listed |
| fedoraproject fedora | = 34 | No fix listed |
| fedoraproject fedora | = 35 | No fix listed |
| netapp h300s firmware | All versions | No fix listed |
| netapp h500s firmware | All versions | No fix listed |
| netapp h700s firmware | All versions | No fix listed |
| netapp h300e firmware | All versions | No fix listed |
| netapp h500e firmware | All versions | No fix listed |
| netapp h700e firmware | All versions | No fix listed |
| netapp h410s firmware | All versions | No fix listed |
| netapp h410c firmware | All versions | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| Siemens sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
| oracle http server | = 12.2.1.3.0 | No fix listed |
| oracle http server | = 12.2.1.4.0 | No fix listed |
| oracle zfs storage appliance kit | = 8.8 | No fix listed |
| alpine/bind(Alpine:v3.12) | >= 9.3.0, < 9.16.27-r0 | 9.16.27-r0 |
| alpine/bind(Alpine:v3.13) | >= 9.3.0, < 9.16.25-r0 | 9.16.25-r0 |
| alpine/bind(Alpine:v3.14) | >= 9.3.0, < 9.16.25-r0 | 9.16.25-r0 |
| alpine/bind(Alpine:v3.15) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.16) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.17) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.18) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.19) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.20) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.21) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.22) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.23) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| alpine/bind(Alpine:v3.24) | >= 9.3.0, < 9.16.22-r0 | 9.16.22-r0 |
| isc BIND9 | = Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36 | No fix listed |
| isc BIND9 | = Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22 | No fix listed |
| isc BIND9 | = Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1 | No fix listed |
| isc BIND9 | = Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.22-S1 | No fix listed |
| isc BIND9 | = Development Branch 9.17 9.17.0 through versions before 9.17.19 | No fix listed |
References
- Debian Security Tracker CVE-2021-25219 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-5126-1 vendor-advisory
- USN-5126-2 vendor-advisory
- www.cve.org
- cert-portal.siemens.com patch third-party-advisory
- kb.isc.org vendor-advisory
- [debian-lts-announce] 20211102 [SECURITY] [DLA 2807-1] bind9 security update mailing-list third-party-advisory
- FEDORA-2021-eb8dab50ba vendor-advisory
- FEDORA-2021-39b33260b8 vendor-advisory
- FEDORA-2021-58e7b873b7 vendor-advisory
- GLSA-202210-25 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- DSA-4994 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- security.alpinelinux.org vendor-advisory