CVE-2023-6516

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

• nxdomain-redirect <domain>; is configured, and
• the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

• nxdomain-redirect <domain>; is configured, and
• the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

• nxdomain-redirect <domain>; is configured, and
• the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

• nxdomain-redirect <domain>; is configured, and
• the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind9: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)
• bind9: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517)
• bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679)
• bind9: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)
• bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
• bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)
• bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
• bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)
• bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679)
• bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517)
• bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)
• bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
• bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)
• bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679)
• bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517)
• bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

Bug Fix(es):

• bind-dyndb-ldap: rebuilt to adapt ABI changes in bind

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2023-5517: fix a flaw causing named to crash with an assertion failure when nxdomain-redirect is set, and a PTR query for an RFC 1918 address returns NXDOMAIN
• CVE-2023-5679: fix a crash in named due to an assertion failure during recursive resolution when both DNS64 and serve-stale are enabled
• CVE-2023-6516: fix a vulnerability where named may exceed max-cache-size due to unbounded growth of queued cache cleanup events

• CVE-2023-6516: bound the memory used to queue RBTDB tree-pruning events, so that recursive query patterns which continuously trigger cache-database maintenance can no longer exceed max-cache-size and exhaust host memory (DoS)
• CVE-2023-6516 follow-up: make the tree-pruning queue per-node-lock bucketed and process it in quanta, so that the queue introduced above does not starve cache cleanup under load and let cache memory grow without bound
• CVE-2023-6516 follow-up: handle a node being re-queued for tree pruning gracefully instead of asserting, and do not append a parent to a pruning list it is already on, avoiding an assertion failure (DoS) and pruning-list corruption reachable through normal cache activity
• CVE-2023-6516 follow-up: adopt the pruning design upstream settled on in 9.16.49 - run tree pruning on a dedicated task with an unlimited quantum instead of sharing the quantum-1 cache database task, clean every eligible ancestor in a single pass, and re-create both tasks when the cache is flushed so that pruning keeps working after "rndc flush"

• CVE-2023-6516: bound the memory used to queue RBTDB tree-pruning events, so that recursive query patterns which continuously trigger cache-database maintenance can no longer exceed max-cache-size and exhaust host memory (DoS)
• CVE-2023-6516 follow-up: make the tree-pruning queue per-node-lock bucketed and process it in quanta, so that the queue introduced above does not starve cache cleanup under load and let cache memory grow without bound
• CVE-2023-6516 follow-up: handle a node being re-queued for tree pruning gracefully instead of asserting, and do not append a parent to a pruning list it is already on, avoiding an assertion failure (DoS) and pruning-list corruption reachable through normal cache activity
• CVE-2023-6516 follow-up: adopt the pruning design upstream settled on in 9.16.49 - run tree pruning on a dedicated task with an unlimited quantum instead of sharing the quantum-1 cache database task, clean every eligible ancestor in a single pass, and re-create both tasks when the cache is flushed so that pruning keeps working after "rndc flush"

• CVE-2023-6516: bound the memory used to queue RBTDB tree-pruning events, so that recursive query patterns which continuously trigger cache-database maintenance can no longer exceed max-cache-size and exhaust host memory (DoS)
• CVE-2023-6516 follow-up: make the tree-pruning queue per-node-lock bucketed and process it in quanta, so that the queue introduced above does not starve cache cleanup under load and let cache memory grow without bound
• CVE-2023-6516 follow-up: handle a node being re-queued for tree pruning gracefully instead of asserting, and do not append a parent to a pruning list it is already on, avoiding an assertion failure (DoS) and pruning-list corruption reachable through normal cache activity
• CVE-2023-6516 follow-up: adopt the pruning design upstream settled on in 9.16.49 - run tree pruning on a dedicated task with an unlimited quantum instead of sharing the quantum-1 cache database task, clean every eligible ancestor in a single pass, and re-create both tasks when the cache is flushed so that pruning keeps working after "rndc flush"

• SECURITY UPDATE: named running as a recursive resolver could be driven to exceed the configured max-cache-size, and exhaust available memory, because tree-pruning cleanup events were queued faster than they were processed
  • debian/patches/CVE-2023-6516.patch: limit isc_task_send() overhead for tree pruning (upstream c3377cbfaa)
  • debian/patches/CVE-2023-6516-lock-contention.patch: reduce lock contention during RBTDB tree pruning (upstream 801e888d03)
  • debian/patches/CVE-2023-6516-prune-guards.patch: guard re-queueing a node for pruning (upstream f6289ad931, 4b6fc97af6, 7d9be24bb1)
  • debian/patches/CVE-2023-6516-final-design.patch: the pruning design upstream settled on in 9.16.49, GL #4621 (upstream a548312191, eba7fb5f9f, 5f98eba608); adds dns_db_setprunetask() rather than changing the dns_db_settask() ABI
  • debian/libdns1104.symbols: record the three entry points the last patch adds
  • CVE-2023-6516

• CVE-2023-6516: unbounded memory growth in a resolver's cache; every RBTDB node queued for tree pruning allocated an event on the cache's quantum-1 database task, so a remote client could make the queue of outstanding pruning events grow without limit. Tree pruning now runs on a task of its own that drains its whole queue before yielding, and the task is created together with the database so that it survives a cache flush

• CVE-2023-6516: unbounded memory growth in a resolver's cache; every RBTDB node queued for tree pruning allocated an event on the cache's quantum-1 database task, so a remote client could make the queue of outstanding pruning events grow without limit. Tree pruning now runs on a task of its own that drains its whole queue before yielding, and the task is created together with the database so that it survives a cache flush

• CVE-2023-6516: unbounded growth of the asynchronous RBTDB tree-pruning queue let a recursive resolver exceed the configured max-cache-size; tree pruning now runs on a dedicated task with an unlimited quantum so queued cleanup events cannot accumulate into a backlog

• SECURITY UPDATE: unbounded growth of the asynchronous RBT cache-cleanup queue lets max-cache-size be exceeded
  • debian/patches/CVE-2023-6516.patch: limit isc_task_send() overhead for tree pruning (upstream c3377cbfaa).
  • debian/patches/CVE-2023-6516-lock-contention.patch: reduce lock contention during RBTDB tree pruning (upstream 801e888d03).
  • debian/patches/CVE-2023-6516-prune-guards.patch: guard re-queueing a node for pruning (upstream f6289ad931, 4b6fc97af6, 7d9be24bb1).
  • debian/patches/CVE-2023-6516-final-design.patch: the design upstream settled on in 9.16.49, GL #4621 (upstream a548312191, eba7fb5f9f, 5f98eba608). Drops the prunenodes lists, so dns_rbtnode is unchanged and MAPAPI stays at 1.0.
  • CVE-2023-6516

• SECURITY UPDATE: unbounded cache-cleanup event queue lets a query pattern drive named past max-cache-size
  • debian/patches/CVE-2023-6516.patch: send tree-pruning events to a dedicated rbtdb pruning task whose quantum is effectively unlimited instead of the quantum-1 rbtdb->task, so the pruning queue drains at least as fast as it is fed; traverse every eligible ancestor in one prune_tree() execution; create the cache database tasks in cache_create_db() so a cache flush keeps pruning alive
  • takes upstream's final 9.16.49 design (GL #4596, GL #4621) and not the superseded prunenodes-list design, so struct dns_rbtnode is unchanged and MAPAPI stays at 1.1
  • only decrement_reference() queues prune events on 9.10.3; cleanup_dead_nodes() drains synchronously and is left untouched
  • dns_db_settask() takes a second task argument; no reverse dependency in this ELS set consumes that symbol
  • CVE-2023-6516

These are all security issues fixed in the bind-9.18.24-1.1 package on the GA media of openSUSE Tumbleweed.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind9: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

• bind9: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517)

• bind9: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679)

• bind9: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)

• bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

• bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

• bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

• bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)

• bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679)

• bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517)

• bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

Bug Fix(es):

• bind-dyndb-ldap: rebuilt to adapt ABI changes in bind

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for bind fixes the following issues:

Update to release 9.16.48:

• CVE-2023-50387: Fixed a denial-of-service caused by DNS messages containing a lot of DNSSEC signatures (bsc#1219823).
• CVE-2023-50868: Fixed a denial-of-service caused by NSEC3 closest encloser proof (bsc#1219826).
• CVE-2023-4408: Fixed a denial-of-service caused by DNS messages with many different names (bsc#1219851).
• CVE-2023-5517: Fixed a possible crash when nxdomain-redirect was enabled (bsc#1219852).
• CVE-2023-5679: Fixed a possible crash when bad interaction between DNS64 and serve-stale, when both of these features are enabled (bsc#1219853).
• CVE-2023-6516: Fixed excessive memory consumption when continuously trigger the cache database maintenance (bsc#1219854).

This update for bind fixes the following issues:

Update to release 9.16.48:

Feature Changes:

• The IP addresses for B.ROOT-SERVERS.NET have been updated to 170.247.170.2 and 2801:1b8:10::b.

Security Fixes:

• Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) [bsc#1219823]
• Preparing an NSEC3 closest encloser proof could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50868) [bsc#1219826]
• Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) [bsc#1219851]
• Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [bsc#1219852]
• A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [bsc#1219853]
• Query patterns that continuously triggered cache database maintenance could cause an excessive amount of memory to be allocated, exceeding max-cache-size and potentially leading to all available memory on the host running named being exhausted. This has been fixed. (CVE-2023-6516) [bsc#1219854]

Removed Features:

• Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead.

This update for bind fixes the following issues:

• CVE-2023-4408: Fixed denial of service during DNS message parsing with different names (bsc#1219851)
• CVE-2023-50387: Fixed denial of service during DNS messages validation with DNSSEC signatures (bsc#1219823)
• CVE-2023-50868: Fixed denial of service during NSEC3 closest encloser proof preparation (bsc#1219826)
• CVE-2023-5517: Fixed denial of service caused by specific queries with nxdomain-redirect enabled (bsc#1219852)
• CVE-2023-6516: Fixed denial of service caused by specific queries that continuously triggered cache database maintenance (bsc#1219854)

This update for bind fixes the following issues:

• CVE-2023-4408: Fixed denial of service during DNS message parsing with different names (bsc#1219851)
• CVE-2023-50387: Fixed denial of service during DNS messages validation with DNSSEC signatures (bsc#1219823)
• CVE-2023-50868: Fixed denial of service during NSEC3 closest encloser proof preparation (bsc#1219826)
• CVE-2023-5517: Fixed denial of service caused by specific queries with nxdomain-redirect enabled (bsc#1219852)
• CVE-2023-6516: Fixed denial of service caused by specific queries that continuously triggered cache database maintenance (bsc#1219854)

Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-4408)

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Bind icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-50387)

It was discovered that Bind incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-50868)

It was discovered that Bind incorrectly handled reverse zone queries when nxdomain-redirect is enabled. A remote attacker could possibly use this issue to cause Bind to crash, leading to a denial of service. (CVE-2023-5517)

It was discovered that Bind incorrectly handled certain specific recursive query patterns. A remote attacker could possibly use this issue to cause Bind to consume memory, leading to a denial of service. (CVE-2023-6516)

Bind has been updated to 9.6.48. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://downloads.isc.org/isc/bind9/9.16.48/doc/arm/html/notes.html