What is CVE-2022-3488?

CVE-2022-3488 is a high-severity vulnerability in Isc Bind, classified under Reachable Assertion. CVSS score: 7.5/10. Published 2023-01-26.

How severe is CVE-2022-3488?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2022-3488 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Isc Bind

CVE-2022-3488

Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.

EPSS: 0.192 (97.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Isc Bind — versions 9.11.4, 9.11.37, 9.16.8
Isc Bind 9 — versions 9.11.4-S1, 9.16.8-S1

Weakness classification (CWE)

CWE-617 — Reachable Assertion

Public proof-of-concept exploits

krlabs/dnsbind-vulnerabilities

References

security-officer@isc.org (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2022-3488?: CVE-2022-3488 is a high-severity vulnerability in Isc Bind, classified under Reachable Assertion. CVSS score: 7.5/10. Published 2023-01-26.
How severe is CVE-2022-3488?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2022-3488 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.