CVE-2021-25218
In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.
- Affected products
- Bind, Bind Server
- Isc Bind
- = 9.16.19, 9.17.16
- Fix
- Available
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 3.6% (88th percentile)
- Weakness
- CWE-617
- NVD status
- Modified
- Published
- 2021-08-18
Fix
Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.20 BIND 9.17.17 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9.16.20-S1
Workaround
Disabling RRL in all views, including the built-in CHAOS class view "_bind", prevents the faulty assertion from being reached. This can be done by removing all existing rate-limit statements from named.conf, and defining a replacement for the default CHAOS view: view override_bind chaos { recursion no; notify no; allow-new-zones no; max-cache-size 2M; zone "version.bind" chaos { type primary; database "_builtin version"; }; zone "hostname.bind" chaos { type primary; database "_builtin hostname"; }; zone "authors.bind" chaos { type primary; database "_builtin authors"; }; zone "id.server" chaos { type primary; database "_builtin id"; }; };
No indexed exploits for CVE-2021-25218 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-25218 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.