Resource exhaustion in Containers Aardvark-Dns
CVE-2024-8418
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.008 (53.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Containers Aardvark-Dns — versions 1.12.0, 1.12.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9 — versions 2:1.14.0-1.el9
- Red Hat In-Vehicle Operating System 1
- Red Hat Openshift Container Platform 4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- access.redhat.com/errata/RHSA-2025:7094 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2024-8418 (Third Party Advisory, vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Issue Tracking)
- github.com/containers/aardvark-dns/issues/500 (Exploit, Issue Tracking)
- github.com/containers/aardvark-dns/pull/503 (Issue Tracking)
Frequently asked questions
- What is CVE-2024-8418?
- CVE-2024-8418 is a high-severity vulnerability in Containers Aardvark-Dns, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2024-09-04.
- How severe is CVE-2024-8418?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-8418 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.