title: Memory leaks in EdDSA DNSSEC verification code
description: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
problem types: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.11.4-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, the DNSSEC verification code for the EdDSA algorithm leaks memory when there is a signature length mismatch.
affected:
{
vendor: ISC
product: BIND9
versions:
version: Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13, status: affected
version: Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8, status: affected
version: Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33, status: affected
version: Open Source Branch 9.18 9.18.0 through versions before 9.18.7, status: affected
version: Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1, status: affected
version: Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1, status: affected
version: Development Branch 9.19 9.19.0 through versions before 9.19.5, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
]
exploits: This flaw was discovered in internal testing. We are not aware of any active exploits.
solutions: Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.
workarounds: Disable the following algorithms in your configuration using the disable-algorithms option: ED25519, ED448. Note that this causes zones signed with these algorithms to be treated as insecure.