CVE-2021-25219

Lame cache can be abused to severely degrade resolver performance

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

En BIND versiones 9.3.0 posteriores a 9.11.35, versiones 9.12.0 posteriores a 9.16.21, y en versiones 9.9.3-S1 posteriores a 9.11.35-S1 y versiones 9.16.8-S1 posteriores a 9.16.21-S1 de BIND Supported Preview Edition, así como en las versiones 9.17.0 -> 9.17.18 de la rama de desarrollo de BIND 9.17, una explotación de servidores autoritativos rotos usando un fallo en el procesamiento de respuestas puede causar una degradación en el rendimiento del resolver BIND. La forma en que está diseñada actualmente la caché de lame hace posible que sus estructuras de datos internas crezcan casi infinitamente, lo que puede causar retrasos significativos en el procesamiento de las consultas de los clientes

A flaw was found in the way bind processes broken responses from authoritative servers. This caching mechanism could be abused by an attacker to significantly degrade resolver performance.

*Credits: ISC would like to thank Kishore Kumar Kothapalli of Infoblox for bringing this vulnerability to our attention.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-15 CVE Reserved
2021-10-27 CVE Published
2024-07-12 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (12)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html	Mailing List
https://security.netapp.com/advisory/ntap-20211118-0002	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	2023-11-07

URL	Date	SRC
https://kb.isc.org/v1/docs/cve-2021-25219	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX	2023-11-07
https://security.gentoo.org/glsa/202210-25	2023-11-07
https://www.debian.org/security/2021/dsa-4994	2023-11-07
https://access.redhat.com/security/cve/CVE-2021-25219	2022-05-10
https://bugzilla.redhat.com/show_bug.cgi?id=2017636	2022-05-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Netapp Search vendor "Netapp"	H300s Firmware Search vendor "Netapp" for product "H300s Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H300s Search vendor "Netapp" for product "H300s"	-	-	Safe
Netapp Search vendor "Netapp"	H500s Firmware Search vendor "Netapp" for product "H500s Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H500s Search vendor "Netapp" for product "H500s"	-	-	Safe
Netapp Search vendor "Netapp"	H700s Firmware Search vendor "Netapp" for product "H700s Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H700s Search vendor "Netapp" for product "H700s"	-	-	Safe
Netapp Search vendor "Netapp"	H300e Firmware Search vendor "Netapp" for product "H300e Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H300e Search vendor "Netapp" for product "H300e"	-	-	Safe
Netapp Search vendor "Netapp"	H500e Firmware Search vendor "Netapp" for product "H500e Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H500e Search vendor "Netapp" for product "H500e"	-	-	Safe
Netapp Search vendor "Netapp"	H700e Firmware Search vendor "Netapp" for product "H700e Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H700e Search vendor "Netapp" for product "H700e"	-	-	Safe
Netapp Search vendor "Netapp"	H410s Firmware Search vendor "Netapp" for product "H410s Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H410s Search vendor "Netapp" for product "H410s"	-	-	Safe
Netapp Search vendor "Netapp"	H410c Firmware Search vendor "Netapp" for product "H410c Firmware"	-	-	Affected	in	Netapp Search vendor "Netapp"	H410c Search vendor "Netapp" for product "H410c"	-	-	Safe
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				>= 9.3.0 < 9.11.36 Search vendor "Isc" for product "Bind" and version " >= 9.3.0 < 9.11.36"		-		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				>= 9.12.0 < 9.16.22 Search vendor "Isc" for product "Bind" and version " >= 9.12.0 < 9.16.22"		-		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				>= 9.17.0 < 9.17.19 Search vendor "Isc" for product "Bind" and version " >= 9.17.0 < 9.17.19"		-		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.3 Search vendor "Isc" for product "Bind" and version "9.9.3"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.12 Search vendor "Isc" for product "Bind" and version "9.9.12"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.9.13 Search vendor "Isc" for product "Bind" and version "9.9.13"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.5 Search vendor "Isc" for product "Bind" and version "9.10.5"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.10.7 Search vendor "Isc" for product "Bind" and version "9.10.7"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.3 Search vendor "Isc" for product "Bind" and version "9.11.3"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.5 Search vendor "Isc" for product "Bind" and version "9.11.5"		s3, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.5 Search vendor "Isc" for product "Bind" and version "9.11.5"		s5, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.5 Search vendor "Isc" for product "Bind" and version "9.11.5"		s6, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.6 Search vendor "Isc" for product "Bind" and version "9.11.6"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.7 Search vendor "Isc" for product "Bind" and version "9.11.7"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.8 Search vendor "Isc" for product "Bind" and version "9.11.8"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.12 Search vendor "Isc" for product "Bind" and version "9.11.12"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.21 Search vendor "Isc" for product "Bind" and version "9.11.21"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.27 Search vendor "Isc" for product "Bind" and version "9.11.27"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.29 Search vendor "Isc" for product "Bind" and version "9.11.29"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.11.35 Search vendor "Isc" for product "Bind" and version "9.11.35"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.16.8 Search vendor "Isc" for product "Bind" and version "9.16.8"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.16.11 Search vendor "Isc" for product "Bind" and version "9.16.11"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.16.13 Search vendor "Isc" for product "Bind" and version "9.16.13"		s1, supported_preview		Affected
Isc Search vendor "Isc"		Bind Search vendor "Isc" for product "Bind"				9.16.21 Search vendor "Isc" for product "Bind" and version "9.16.21"		s1, supported_preview		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				33 Search vendor "Fedoraproject" for product "Fedora" and version "33"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Netapp Search vendor "Netapp"		Cloud Backup Search vendor "Netapp" for product "Cloud Backup"				-		-		Affected
Siemens Search vendor "Siemens"		Sinec Infrastructure Network Services Search vendor "Siemens" for product "Sinec Infrastructure Network Services"				< 1.0.1.1 Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1"		-		Affected
Oracle Search vendor "Oracle"		Http Server Search vendor "Oracle" for product "Http Server"				12.2.1.3.0 Search vendor "Oracle" for product "Http Server" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Http Server Search vendor "Oracle" for product "Http Server"				12.2.1.4.0 Search vendor "Oracle" for product "Http Server" and version "12.2.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Zfs Storage Appliance Kit Search vendor "Oracle" for product "Zfs Storage Appliance Kit"				8.8 Search vendor "Oracle" for product "Zfs Storage Appliance Kit" and version "8.8"		-		Affected