CVE-2021-25219

Lame cache can be abused to severely degrade resolver performance

State: Published
Severity: 5.3 Medium
Published: Oct 27, 2021
Updated: Sep 16, 2024
Reserved: Jan 15, 2021

Description

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	isc

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
BIND9ISC	Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36Affected Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22Affected Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1Affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.22-S1Affected Development Branch 9.17 9.17.0 through versions before 9.17.19Affected

Product

Versions

BIND9ISC

Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36Affected
Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22Affected
Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1Affected
Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.22-S1Affected
Development Branch 9.17 9.17.0 through versions before 9.17.19Affected

References

https://kb.isc.org/v1/docs/cve-2021-25219
DSA-4994vendor-advisory
[debian-lts-announce] 20211102 [SECURITY] [DLA 2807-1] bind9 security updatemailing-list
FEDORA-2021-58e7b873b7vendor-advisory
FEDORA-2021-39b33260b8vendor-advisory
FEDORA-2021-eb8dab50bavendor-advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://security.netapp.com/advisory/ntap-20211118-0002/
GLSA-202210-25vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.