PT-2022-4907 · Openssl+5 · Openssl+5

Published 2022-08-18 · Updated 2024-06-15 · CVE-2022-2906

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIND versions prior to the fixed version

Description The issue allows an attacker to gradually erode available memory, potentially causing the named service to crash due to lack of resources. Upon restart, the attacker would have to begin again, but there is still the potential to deny service. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is related to a memory leak when handling TKEY records using the Diffie-Hellman key exchange algorithm with OpenSSL 3.0.0 and later versions.

Recommendations For BIND versions prior to the fixed version, consider applying a patch or update to resolve the issue. As a temporary workaround, restrict access to the TKEY records handling functionality to minimize the risk of exploitation. Additionally, monitor system resources to quickly detect and respond to potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2022-06070

CVE-2022-2906

OESA-2022-1981

OESA-2022-1982

OESA-2022-1983

OPENSUSE-SU-2024:12356-1

USN-5626-1

Affected Products

Bind

Bind Server

Linuxmint

Openssl

Red Os

Ubuntu

References · 47

• http://openwall.com/lists/oss-security/2022/09/21/3 · Patch
• https://kb.isc.org/docs/cve-2022-2906 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2906 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1982 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-25 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38177 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2906 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-2906 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2906 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2881 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2906 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2906 · Security Note
• https://bdu.fstec.ru/vul/2022-06070 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38177 · Security Note