This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.
If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bind9.16-libsUpgrade bind-dnssec-utilsUpgrade bind-docUpgrade bind-dnssec-docUpgrade bind-chrootUpgrade python3-bindUpgrade bind9.16-docUpgrade bind9.16-develUpgrade bind9.16-licenseUpgrade bind9.16-utilsUpgrade bind-utilsUpgrade bind-libsUpgrade bind9.16-dnssec-utilsUpgrade bind9.16-chrootUpgrade bind9.16Upgrade bind-develUpgrade bindUpgrade bind-licenseUpgrade python3-bind9.16 | May 15, 2023 | Jan 26, 2023 |
| Alpine Linux | — | Upgrade bind | Aug 22, 2024 | Jan 25, 2023 |
| Amazon_linux_2023 | — | Upgrade bind-dnssec-utils-debuginfoUpgrade bind-dlz-ldapUpgrade bind-dlz-mysql-debuginfoUpgrade bind-libs-debuginfoUpgrade bind-licenseUpgrade bind-dnssec-utilsUpgrade bind-debugsourceUpgrade bind-pkcs11Upgrade bind-dlz-sqlite3-debuginfoUpgrade bind-dlz-mysqlUpgrade bind-pkcs11-develUpgrade bindUpgrade bind-develUpgrade bind-dlz-ldap-debuginfoUpgrade python3-bindUpgrade bind-dlz-filesystem-debuginfoUpgrade bind-pkcs11-libsUpgrade bind-dnssec-docUpgrade bind-pkcs11-utils-debuginfoUpgrade bind-pkcs11-utilsUpgrade bind-utilsUpgrade bind-dlz-sqlite3Upgrade bind-utils-debuginfoUpgrade bind-dlz-filesystemUpgrade bind-debuginfoUpgrade bind-pkcs11-libs-debuginfoUpgrade bind-libsUpgrade bind-pkcs11-debuginfoUpgrade bind-chroot | Feb 17, 2025 | Jan 25, 2023 |
| Centos_linux | — | Upgrade bind-debugsourceUpgrade bind9.16-libs-debuginfoUpgrade bind9.16Upgrade bind9.16-dnssec-utils-debuginfoUpgrade bind-debuginfoUpgrade bind-utilsUpgrade bind-utils-debuginfoUpgrade bind-dnssec-utilsUpgrade bindUpgrade bind-chrootUpgrade bind9.16-libsUpgrade bind-dnssec-docUpgrade bind9.16-debugsourceUpgrade python3-bindUpgrade bind9.16-debuginfoUpgrade bind9.16-chrootUpgrade bind9.16-utilsUpgrade bind-licenseUpgrade bind-dnssec-utils-debuginfoUpgrade python3-bind9.16Upgrade bind9.16-utils-debuginfoUpgrade bind9.16-licenseUpgrade bind9.16-dnssec-utilsUpgrade bind-libs-debuginfoUpgrade bind-libs | May 15, 2023 | Jan 26, 2023 |
| Debian | — | Upgrade bind9 | Jan 30, 2023 | Jan 26, 2023 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Mar 7, 2023 | Jan 26, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bind-pkcs11-libsUpgrade bind-licenseUpgrade bind-pkcs11-utilsUpgrade bind-pkcs11Upgrade bind-utilsUpgrade bind-libsUpgrade python3-bindUpgrade bindUpgrade bind-dnssec-utilsUpgrade bind-dnssec-docUpgrade bind-chroot | May 8, 2023 | Jan 26, 2023 |
| Ibm Aix | — | Apply the fix or workaround for bind_advisory23 | Jul 27, 2023 | Jan 26, 2023 |
| Oracle_linux | — | Upgrade bind9.16Upgrade python3-bindUpgrade bind9.16-develUpgrade bind9.16-chrootUpgrade bind9.16-dnssec-utilsUpgrade python3-bind9.16Upgrade bind9.16-utilsUpgrade bind-libsUpgrade bind-develUpgrade bind-dnssec-docUpgrade bindUpgrade bind-dnssec-utilsUpgrade bind-chrootUpgrade bind9.16-docUpgrade bind9.16-libsUpgrade bind9.16-licenseUpgrade bind-utilsUpgrade bind-licenseUpgrade bind-doc | May 18, 2023 | Jan 25, 2023 |
| Redhat_linux | — | Upgrade python3-bind9.16Upgrade bindUpgrade bind9.16-chrootUpgrade bind9.16-dnssec-utilsUpgrade bind-libs-debuginfoUpgrade bind-libsUpgrade bind9.16-utils-debuginfoUpgrade bind9.16-utilsUpgrade bind9.16-debuginfoUpgrade bind9.16-licenseUpgrade bind-licenseUpgrade bind-dnssec-utils-debuginfoUpgrade bind-debugsourceUpgrade bind-utils-debuginfoUpgrade bind9.16-libs-debuginfoUpgrade bind9.16Upgrade bind-docUpgrade bind-utilsUpgrade bind9.16-docUpgrade bind-chrootUpgrade bind-debuginfoUpgrade bind9.16-libsUpgrade bind9.16-debugsourceUpgrade bind9.16-dnssec-utils-debuginfoUpgrade python3-bindUpgrade bind-dnssec-utilsUpgrade bind9.16-develUpgrade bind-dnssec-docUpgrade bind-devel | May 15, 2023 | Jan 26, 2023 |
| Suse | — | Upgrade bind-docUpgrade bind-utilsUpgrade python3-bindUpgrade bind | Feb 13, 2023 | Jan 26, 2023 |
| Ubuntu | — | Upgrade bind9 | Mar 22, 2023 | Jan 26, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub