Vulnerability in Isc Bind
CVE-2022-38178
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
EPSS: 0.022 (80.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Isc Bind — versions 9.11.3, 9.11.5, 9.11.6
- Isc Bind9 — versions Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13, Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8, Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33
- Netapp Active_iq_unified_manager
- Debian Debian_linux — versions 11.0
- Fedoraproject Fedora — versions 35, 36, 37
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-officer@isc.org (Mailing List, Third Party Advisory)
- security-officer@isc.org (mailing-list, Patch, Mailing List, Third Party Advisory)
- security-officer@isc.org (vendor-advisory, Third Party Advisory)
- security-officer@isc.org (vendor-advisory)
- security-officer@isc.org (vendor-advisory)
- security-officer@isc.org (vendor-advisory)
- security-officer@isc.org (mailing-list, Mailing List, Third Party Advisory)
- security-officer@isc.org (vendor-advisory, Third Party Advisory)
- security-officer@isc.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-38178?
- CVE-2022-38178 is a high-severity vulnerability in Isc Bind, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 7.5/10. Published 2022-09-21.
- How severe is CVE-2022-38178?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-38178 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.