BIND 9 Resource Exhaustion Vulnerability via Malformed DNSKEY Records

A resource exhaustion vulnerability has been identified in BIND 9. This issue arises when records are queried from a specially crafted zone containing certain malformed DNSKEY records, leading to CPU exhaustion. The vulnerability affects BIND 9 versions 9.18.0 prior to 9.18.39, 9.20.0 prior to 9.20.13, 9.21.0 prior to 9.21.12, as well as BIND Supported Preview Edition versions 9.18.11-S1 prior to 9.18.39-S1 and 9.20.9-S1 prior to 9.20.13-S1. While resolvers are affected by this vulnerability, authoritative services are believed to be unaffected.

Impact

Exploitation of this vulnerability can lead to significant performance degradation, causing denial-of-service conditions for legitimate clients by overwhelming the server's CPU resources.

Remediation

Users are advised to upgrade to BIND 9.18.41, 9.20.15, or 9.21.14. For BIND Supported Preview Edition, upgrade to version 9.18.41-S1 or 9.20.15-S1.