CVE-2021-25219
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
- Affected products
- Alt Linux, Almalinux, Astra Linux, Bind, Bind Server, Centos, Ibm Aix, Linuxmint
- Isc Bind
- < 9.11.36, 9.16.22, 9.17.19, 9.9.3, 9.9.12, 9.9.13, 9.10.5, 9.10.7, 9.11.3, 9.11.5, 9.11.6, 9.11.7, 9.11.8, 9.11.12, 9.11.21, 9.11.27, 9.11.29, 9.11.35, 9.16.8, 9.16.11, 9.16.13, 9.16.21
- Fix
- Available
- CVSS 3.1
- 5.3 MEDIUM
- EPSS
- 8.1% (94th percentile)
- NVD status
- Modified
- Published
- 2021-10-27
Fix
Upgrade to the patched release most closely related to your current version of BIND: BIND 9.11.36, BIND 9.16.22, BIND 9.17.19, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.11.36-S1, BIND 9.16.22-S1.
Workaround
Setting "lame-ttl 0;" disables the lame cache and prevents the performance issue. Our research and testing indicate that in the current Internet there is almost no downside to disabling the lame cache.
No indexed exploits for CVE-2021-25219 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-25219 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.