CVE-2023-4236: named may terminate unexpectedly under high DNS-over-TLS query load

Q: What is CVE-2023-4236?

CVE-2023-4236 is a vulnerability in BIND 9, the DNS server software developed by ISC.

Q: How does CVE-2023-4236 affect BIND 9?

CVE-2023-4236 affects BIND 9 versions 9.18.0 through 9.18.18.

Q: What is the severity of CVE-2023-4236?

The severity of CVE-2023-4236 is rated as high, with a CVSS score of 7.5.

Q: What is the impact of CVE-2023-4236?

CVE-2023-4236 may cause the 'named' process to terminate unexpectedly due to an assertion failure, leading to a denial of service (DoS) condition.

Q: How can I mitigate CVE-2023-4236?

To mitigate CVE-2023-4236, it is recommended to update BIND 9 to a version that includes the necessary fixes, such as 9.18.19.

Published Sep 20, 2023

Updated

A flaw in the networking code handling DNS-over-TLS queries may cause named to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

Affected Software

25 affected componentsFixes available

debian/bind9<=1:9.18.16-1~deb12u1, <=1:9.18.16-1

1:9.18.19-1~deb12u11:9.19.17-1

debian/bind9

1:9.11.5.P4+dfsg-5.1+deb10u71:9.11.5.P4+dfsg-5.1+deb10u101:9.16.44-1~deb11u11:9.16.48-11:9.18.19-1~deb12u11:9.18.24-11:9.19.21-1

ubuntu/bind9<1:9.18.12-0ubuntu0.22.04.3

1:9.18.12-0ubuntu0.22.04.3

ubuntu/bind9<1:9.18.12-1ubuntu1.2

1:9.18.12-1ubuntu1.2

ubuntu/bind9<1:9.18.18-0ubuntu2

1:9.18.18-0ubuntu2

ubuntu/bind9<1:9.18.18-0ubuntu2

1:9.18.18-0ubuntu2

ubuntu/bind9<9.18.19

9.18.19

ISC BIND>=9.18.0<9.18.18

ISC BIND=9.18.11-s1

ISC BIND=9.18.18-s1

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Fedoraproject Fedora=39

Debian Debian Linux=10.0

Debian Debian Linux=11.0

All of the following

NetApp H300s Firmware

NetApp H300s

All of the following

NetApp H500s Firmware

NetApp H500s

All of the following

NetApp H700s Firmware

NetApp H700s

All of the following

NetApp H410s Firmware

NetApp H410s

All of the following

NetApp H410c Firmware

NetApp H410c

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.19-1~deb12u1Fixed in 1:9.19.17-1
Upgrade
Upgrade debian/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.11.5.P4+dfsg-5.1+deb10u7Fixed in 1:9.11.5.P4+dfsg-5.1+deb10u10Fixed in 1:9.16.44-1~deb11u1Fixed in 1:9.16.48-1Fixed in 1:9.18.19-1~deb12u1Fixed in 1:9.18.24-1Fixed in 1:9.19.21-1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.12-0ubuntu0.22.04.3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.12-1ubuntu1.2
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.18-0ubuntu2
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 9.18.19
Upgrade
Upgrade BIND 9 to a version that resolves this vulnerability.
Fixed in 9.18.19
Upgrade
Upgrade BIND 9 to a version that resolves this vulnerability.
Fixed in 9.18.19-S1

Event History

Sep 20, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

RemedyDescriptionSeverity

Jan 12, 2024

Data Sourced

via Launchpad·12:25 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6390-1

Frequently Asked Questions

What is CVE-2023-4236?

CVE-2023-4236 is a vulnerability in BIND 9, the DNS server software developed by ISC.

How does CVE-2023-4236 affect BIND 9?

CVE-2023-4236 affects BIND 9 versions 9.18.0 through 9.18.18.

What is the severity of CVE-2023-4236?

The severity of CVE-2023-4236 is rated as high, with a CVSS score of 7.5.

What is the impact of CVE-2023-4236?

CVE-2023-4236 may cause the 'named' process to terminate unexpectedly due to an assertion failure, leading to a denial of service (DoS) condition.

How can I mitigate CVE-2023-4236?

To mitigate CVE-2023-4236, it is recommended to update BIND 9 to a version that includes the necessary fixes, such as 9.18.19.

CVE-2023-4236: named may terminate unexpectedly under high DNS-over-TLS query load

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2023-4236?

How does CVE-2023-4236 affect BIND 9?

What is the severity of CVE-2023-4236?

What is the impact of CVE-2023-4236?

How can I mitigate CVE-2023-4236?

Company

Resources

Contact