CVE-2020-8622 A truncated TSIG response can lead to an assertion failure

Medium 6.5 Published 21 Aug 2020 Updated 16 Sep 2024

An attacker can cause a denial of service in BIND by sending a truncated TSIG response, triggering an assertion failure and crashing the server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-8622?

CVE-2020-8622 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 21 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

Weakness: CWE-617

Which versions are affected by CVE-2020-8622?

It affects 8 products.

Linux distribution packages (35)

`bind` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-chroot` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-devel` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-libs` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-sdb` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-utils` Red Hat:enterprise_linux:6::client	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-chroot` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-devel` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-libs` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-sdb` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-utils` Red Hat:enterprise_linux:6::computenode	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-chroot` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-devel` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-libs` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-sdb` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-utils` Red Hat:enterprise_linux:6::server	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-chroot` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-devel` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-libs` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-sdb` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind-utils` Red Hat:enterprise_linux:6::workstation	All versions	`32:9.8.2-0.68.rc1.el6_10.8`
`bind` SUSE:HPE Helion OpenStack 8	All versions	`9.9.9P1-63.28.1`
`bind` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`9.9.9P1-63.28.1`
`bind` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`9.9.9P1-63.28.1`
`bind` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`9.9.9P1-63.28.1`
`bind` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`9.9.9P1-63.28.1`
`bind` SUSE:OpenStack Cloud 8	All versions	`9.9.9P1-63.28.1`
`bind` SUSE:OpenStack Cloud Crowbar 8	All versions	`9.9.9P1-63.28.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Isc Bind, Netapp Steelstore Cloud Integrated Storage, Opensuse Leap and 2 more.

How do I fix CVE-2020-8622?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-8622 being exploited?

There is no known exploitation of CVE-2020-8622 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2020-8622, DEBIAN-CVE-2020-8622, GHSA-fh6r-7j2f-pmw4, RHSA-2020:4183, SUSE-SU-2021:2876-1, UBUNTU-CVE-2020-8622 and 1 more.