This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero.
If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM recursive-clients limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.
This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bind | Isc | 9.16.12 (including) | 9.16.37 (excluding) |
| Bind | Isc | 9.18.0 (including) | 9.18.11 (excluding) |
| Bind | Isc | 9.19.0 (including) | 9.19.9 (excluding) |
| Bind | Isc | 9.16.12-s1 (including) | 9.16.12-s1 (including) |
| Bind | Isc | 9.16.13-s1 (including) | 9.16.13-s1 (including) |
| Bind | Isc | 9.16.14-s1 (including) | 9.16.14-s1 (including) |
| Bind | Isc | 9.16.21-s1 (including) | 9.16.21-s1 (including) |
| Bind | Isc | 9.16.32-s1 (including) | 9.16.32-s1 (including) |
| Bind | Isc | 9.16.36-s1 (including) | 9.16.36-s1 (including) |
| Red Hat Enterprise Linux 8 | RedHat | bind9.16-32:9.16.23-0.14.el8 | * |
| Red Hat Enterprise Linux 9 | RedHat | bind-32:9.16.23-11.el9 | * |
| Bind9 | Ubuntu | devel | * |
| Bind9 | Ubuntu | jammy | * |
| Bind9 | Ubuntu | kinetic | * |
| Bind9 | Ubuntu | lunar | * |
| Bind9 | Ubuntu | trusty | * |
| Bind9 | Ubuntu | upstream | * |
| Bind9 | Ubuntu | xenial | * |
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.