CVE-2022-3924
Fixed in a distro release EPSS 16%CVSS 7.5
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
Products: ISC BIND 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | bind9.16 | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-chroot | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-devel | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-dnssec-utils | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-doc | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-libs | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-license | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | bind9.16-utils | 32:9.16.23-0.14.el8 |
| AlmaLinux 8 | python3-bind9.16 | 32:9.16.23-0.14.el8 |
| AlmaLinux 9 | bind | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-chroot | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-devel | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-dnssec-doc | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-dnssec-utils | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-doc | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-libs | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-license | 32:9.16.23-11.el9 |
| AlmaLinux 9 | bind-utils | 32:9.16.23-11.el9 |
| AlmaLinux 9 | python3-bind | 32:9.16.23-11.el9 |
| Alpine 3.14 | bind | 9.16.37-r0 |
| Alpine 3.15 | bind | 9.16.37-r0 |
| Alpine 3.16 | bind | 9.16.37-r0 |
| Alpine 3.17 | bind | 9.18.11-r0 |
| Alpine 3.18 | bind | 9.18.11-r0 |
| Alpine 3.19 | bind | 9.18.11-r0 |
| Alpine 3.20 | bind | 9.18.11-r0 |
| Alpine 3.21 | bind | 9.18.11-r0 |
| Alpine 3.22 | bind | 9.18.11-r0 |
| Alpine 3.23 | bind | 9.18.11-r0 |
| Alpine 3.24 | bind | 9.18.11-r0 |
| Chainguard | bind | 9.18.11-r0 |
| Chainguard | bind-dev | 9.18.11-r0 |
| Chainguard | bind-dnssec-root | 9.18.11-r0 |
| Chainguard | bind-dnssec-tools | 9.18.11-r0 |
| Chainguard | bind-doc | 9.18.11-r0 |
| Chainguard | bind-libs | 9.18.11-r0 |
| Chainguard | bind-plugins | 9.18.11-r0 |
| Chainguard | bind-tools | 9.18.11-r0 |
| Debian 11 | bind9 | 1:9.16.37-1~deb11u1 |
| Debian 12 | bind9 | 1:9.18.11-1 |
| Debian 13 | bind9 | 1:9.18.11-1 |
| Debian 14 | bind9 | 1:9.18.11-1 |
| Red Hat Enterprise Linux 8 | bind9.16 | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-chroot | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-debuginfo | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-debugsource | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-devel | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-dnssec-utils | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-dnssec-utils-debuginfo | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-doc | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-libs | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-libs-debuginfo | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-license | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-utils | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | bind9.16-utils-debuginfo | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 8 | python3-bind9.16 | 32:9.16.23-0.14.el8 |
| Red Hat Enterprise Linux 9 | bind | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-chroot | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-debuginfo | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-debugsource | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-devel | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-dnssec-doc | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-dnssec-utils | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-dnssec-utils-debuginfo | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-doc | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-libs | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-libs-debuginfo | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-license | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-utils | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | bind-utils-debuginfo | 32:9.16.23-11.el9 |
| Red Hat Enterprise Linux 9 | python3-bind | 32:9.16.23-11.el9 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | bind | 9.16.37-150400.5.17.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP4 | bind | 9.16.37-150400.5.17.1 |
| Ubuntu 20.04 LTS | bind9 | 1:9.16.1-0ubuntu2.12 |
| Ubuntu 22.04 LTS | bind9 | 1:9.18.1-1ubuntu1.3 |
| Wolfi | bind | 9.18.11-r0 |
| Wolfi | bind-dev | 9.18.11-r0 |
| Wolfi | bind-dnssec-root | 9.18.11-r0 |
| Wolfi | bind-dnssec-tools | 9.18.11-r0 |
| Wolfi | bind-doc | 9.18.11-r0 |
| Wolfi | bind-libs | 9.18.11-r0 |
| Wolfi | bind-plugins | 9.18.11-r0 |
| Wolfi | bind-tools | 9.18.11-r0 |
| openSUSE Leap 15.4 | bind | 9.16.37-150400.5.17.1 |
| openSUSE Tumbleweed | bind | 9.18.11-1.1 |