REDHAT-BUG-2535445: Use After Free
An attacker may be able to cause a named resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the named resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running a vulnerable BIND 9 version are exposed when their named resolver can be induced to query a DNSSEC-signed zone served by an attacker-controlled authoritative server. The affected ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
What must an attacker do to trigger the resolver failure?
The attacker must control the authoritative server for a DNSSEC-signed zone and induce the target resolver to issue multiple queries for that zone. They must then return a particular sequence of crafted answers in a particular order and with particular timing.
What is the expected impact of successful exploitation?
Successful exploitation causes named to encounter a use-after-free condition and abort. The provided information describes resolver termination, not code execution or data disclosure.