K27155546 : BIND vulnerability CVE-2022-38177

Security Advisory Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. (CVE-2022-38177)

Impact

There is no impact; F5 products are not affected by this vulnerability in default, standard, or recommended configurations. However, if the BIND configuration (named.conf) has been modified to enable DNS recursion with therecursion yes;line added to theoptionssection of your BIND configuration file, an attacker can trigger a small memory leak and erode available memory over time, causingnamed to terminate.