Allocation of Resources Without Limits or Throttling Affecting bind9.16-devel package, versions <32:9.16.23-0.7.el8_6.2


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.2% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL8-BIND916DEVEL-5774513
  • published22 Jun 2023
  • disclosed21 Jun 2023

Introduced: 21 Jun 2023

CVE-2023-2828  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade RHEL:8 bind9.16-devel to version 32:9.16.23-0.7.el8_6.2 or higher.
This issue was patched in RHSA-2023:4037.

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind9.16-devel package and not the bind9.16-devel package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.

It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

CVSS Scores

version 3.1