BIND 9: Use After Free
CVE-2022-3094 is a high-severity use after free vulnerability in BIND 9 from ISC, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected BIND 9 versions: 9.16.0 through 9.16.36; 9.18.0 through 9.18.10; 9.19.0 through 9.19.8, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 13.2% chance of exploitation within 30 days, which is in the top 3.56% of all scored CVEs.
EPSS places it among the vulnerabilities most likely to be exploited soon.
What to do
- Update Bind to 9.16.37 or 9.18.11 or 9.19.9, whichever matches your release line, or a later version.
- Read the advisory on kb.isc.org for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| ISC | BIND 9 | 9.16.0 through 9.16.36; 9.18.0 through 9.18.10; 9.19.0 through 9.19.8; 9.16.8-S1 through 9.16.36-S1 | Not stated |
| ISC | Bind | 9.16.0 up to, but not including, 9.16.37; 9.18.0 up to, but not including, 9.18.11; 9.19.0 up to, but not including, 9.19.9; 9.16.8; 9.16.11; 9.16.13; 9.16.14; 9.16.21; and 2 more ranges | 9.16.37, 9.18.11, 9.19.9 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.5 | High | CNA (isc.org) |
| CVSS 3.1 | 7.5 | High | NVD |
Official description
Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Other vulnerabilities in BIND 9
- 7.5 High severity
- 7.5 High severity
- 8.1 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
- 7.8 High severity
Adobe Acrobat and Reader Use-After-Free Exploited
Spotted an error? Tell us.