CVE-2022-38178 Memory leaks in EdDSA DNSSEC verification code

2022-09-2100:00:00

isc

www.cve.org

memory leaks

eddsa

dnssec

spoofing

target resolver

malformed responses

small memory leak

named

crash

lack of resources

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.2%

JSON

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

CNA Affected

[
  {
    "vendor": "ISC",
    "product": "BIND9",
    "versions": [
      {
        "version": "Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13",
        "status": "affected"
      },
      {
        "version": "Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8",
        "status": "affected"
      },
      {
        "version": "Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33",
        "status": "affected"
      },
      {
        "version": "Open Source Branch 9.18 9.18.0 through versions before 9.18.7",
        "status": "affected"
      },
      {
        "version": "Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1",
        "status": "affected"
      },
      {
        "version": "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1",
        "status": "affected"
      },
      {
        "version": "Development Branch 9.19 9.19.0 through versions before 9.19.5",
        "status": "affected"
      }
    ]
  }
]