CVEvulnerability

CVE-2022-38177

7.5 HIGH Published 2022-09-21 Modified 2026-09-01 Official page ↗
Status
Modified
Published
2022-09-21
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401

Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Affected configurations

• isc bind (>= 9.8.4 <= 9.16.32) • isc bind 9.9.3 • isc bind 9.9.12 • isc bind 9.9.13 • isc bind 9.10.5 • isc bind 9.10.7 • isc bind 9.11.3 • isc bind 9.11.5 • isc bind 9.11.6 • isc bind 9.11.7 • isc bind 9.11.8 • isc bind 9.11.12 • isc bind 9.11.14-s1 • isc bind 9.11.19-s1 • isc bind 9.11.21 • isc bind 9.11.27 • isc bind 9.11.29 • isc bind 9.11.35 • isc bind 9.11.37 • isc bind 9.16.8 • isc bind 9.16.11 • isc bind 9.16.13 • isc bind 9.16.21 • isc bind 9.16.32 • debian debian linux 10.0 • debian debian linux 11.0 • fedoraproject fedora 35 • fedoraproject fedora 36 • fedoraproject fedora 37 • netapp active iq unified manager

Related

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References