Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-38177

Memory leak in ECDSA DNSSEC verification code

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC BIND9

  • Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33affected
  • Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1affected
  • Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1affected

References