PT-2024-1672 · Isc+16 · Bind+16
Elias Heftrig
+3
·
Published
2022-10-03
·
Updated
2026-03-10
·
CVE-2023-50387
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
BIND versions prior to the fixed version
Description
The issue is related to the DNSSEC implementation in the DNS protocol, which can be exploited by remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses. This is known as the "KeyTrap" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records, which can lead to CPU exhaustion when there is a zone with many DNSKEY and RRSIG records. The estimated number of potentially affected devices worldwide is not specified. However, it is mentioned that this issue can potentially cause extended Internet outages by sending a single malicious packet that sends DNS servers into an unresolvable loop.
Recommendations
To resolve the issue, users should upgrade to a version of BIND that contains the fix for this vulnerability.
As a temporary workaround, consider using a non-validating resolver to remove the vulnerability, although this is not recommended.
Restrict access to the vulnerable DNSSEC validation module to minimize the risk of exploitation.
Avoid using the
ValidatingResolver for DNSSEC validation until the issue is resolved.Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Bind
Bind Server
Centos
Debian
Freebsd
Ibm Aix
Linuxmint
Powerdns Recursor
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Windows