CVE-2023-5517
Description
A flaw was found in the bind package which may result in a Denial of Service in named process. This is a result of a reachable assertion, leading named to prematurely terminate when both conditions are met: nxdomain-redirect for the queried domain is configured and the resolver receives a PTR query, used for a reverse DNS lookup, for a RFC 1918 address that would normally result in an authoritative NXDOMAIN response. A single query matching both conditions can lead to a Denial of Service in the named application.
Statement
The vulnerability in the bind package represents a important severity issue due to its potential to cause a Denial of Service (DoS) in the named DNS server. This flaw arises from a reachable assertion that triggers a premature termination of the named process when specific conditions are met: a domain configured with nxdomain-redirect and a PTR query for an RFC 1918 address. This scenario can lead to a complete failure of the DNS resolution service, disrupting network operations and availability. Given that DNS services are fundamental for network communication and resource accessibility, such an exploit could result in significant service outages, impacting both internal and external systems reliant on the affected DNS server.
Mitigation
To prevent this vulnerability, ensure the `nxdomain-redirect` directive is not present in the `/etc/named.conf` file. Disabling the nxdomain-redirect feature makes the faulty code path impossible to reach, preventing this flaw from being exploitable.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
