CVE-2022-38178

Memory leaks in EdDSA DNSSEC verification code

State: Published
Severity: 7.5 High
Published: Sep 21, 2022
Updated: May 28, 2025
Reserved: Aug 12, 2022

Description

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	isc

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
BIND9ISC	Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13Affected Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8Affected Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33Affected Open Source Branch 9.18 9.18.0 through versions before 9.18.7Affected Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1Affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1Affected Development Branch 9.19 9.19.0 through versions before 9.19.5Affected

Product

Versions

BIND9ISC

Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13Affected
Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8Affected
Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33Affected
Open Source Branch 9.18 9.18.0 through versions before 9.18.7Affected
Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1Affected
Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1Affected
Development Branch 9.19 9.19.0 through versions before 9.19.5Affected

References

https://kb.isc.org/docs/cve-2022-38178
[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)mailing-list
DSA-5235vendor-advisory
FEDORA-2022-ef038365devendor-advisory
FEDORA-2022-8268735e06vendor-advisory
FEDORA-2022-b197d64471vendor-advisory
[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security updatemailing-list
GLSA-202210-25vendor-advisory
https://security.netapp.com/advisory/ntap-20221228-0009/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.