CVE-2023-2828: named's configured cache size limit can be significantly exceeded
Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
Other sources
Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.
It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded.
— Red Hat
ISC BIND is vulnerable to a denial of service, caused by a flaw that allows the named's configured cache size limit to be significantly exceeded. By querying the resolver for specific RRsets in a certain order, a remote attacker could exploit this vulnerability to exhaust all memory on the host.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.11.3+dfsg-1ubuntu1.19+ - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.9.5.dfsg-3ubuntu0.19+ - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.10.3.dfsg. - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.16.1-0ubuntu2.15 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.12-0ubuntu0.22.04.2 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.12-0ubuntu0.22.10.2 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.12-1ubuntu1.1 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 9.16.42Fixed in 9.18.16Fixed in 9.19.14 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.12-1ubuntu2 - Upgrade
Upgrade
debian/bind9to a version that resolves this vulnerability.Fixed in 1:9.11.5.P4+dfsg-5.1+deb10u10Fixed in 1:9.16.44-1~deb11u1Fixed in 1:9.16.48-1Fixed in 1:9.18.19-1~deb12u1Fixed in 1:9.18.24-1Fixed in 1:9.19.21-1 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.16.42 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.18.16 - Upgrade
Upgrade
redhat/bindto a version that resolves this vulnerability.Fixed in 9.19.14 - Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.16.42 - Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.18.16 - Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.19.14 - Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.16.42-S1 - Upgrade
Upgrade
ISC BIND 9to a version that resolves this vulnerability.Fixed in 9.18.16-S1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-2828?
CVE-2023-2828 is a vulnerability in the BIND DNS software that allows an attacker to bypass the cache validation feature and retrieve invalid data.
How does CVE-2023-2828 affect BIND DNS?
CVE-2023-2828 affects BIND DNS instances configured as recursive resolvers by allowing an attacker to retrieve invalid data from the cache.
What is the severity of CVE-2023-2828?
CVE-2023-2828 has a severity rating of high.
How can I fix CVE-2023-2828?
To fix CVE-2023-2828, you should upgrade to a patched version of BIND DNS.
Where can I find more information about CVE-2023-2828?
You can find more information about CVE-2023-2828 at the following references: [Reference 1](https://kb.isc.org/docs/cve-2023-2828), [Reference 2](http://www.openwall.com/lists/oss-security/2023/06/21/6), [Reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3K6AJK7RRSR53HRF5GGKPA6PDUDWOD2/)