CVE-2021-25219 Lame cache can be abused to severely degrade resolver performance
Attackers can degrade BIND resolver performance by exploiting a flaw in lame cache data structures, causing significant delays in client query processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25219?
CVE-2021-25219 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 27 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
Which versions are affected by CVE-2021-25219?
It affects 15 products.
Linux distribution packages (40)
bind AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-chroot AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-devel AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-export-devel AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-export-libs AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-libs AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-libs-lite AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-license AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-lite-devel AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-pkcs11 AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-devel AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-libs AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-utils AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-sdb AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-sdb-chroot AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind-utils AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
python3-bind AlmaLinux:8 | All versions | 32:9.11.36-3.el8 |
bind Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-chroot Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-export-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-libs Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-libs-lite Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-libs-lite-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-license Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-lite-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11 Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-devel Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-libs Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-utils Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-pkcs11-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-sdb Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-sdb-chroot Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-sdb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
bind-utils Red Hat:enterprise_linux:8::appstream | All versions | 32:9.11.36-3.el8 |
Products include Debian Debian Linux, Fedoraproject Fedora, Isc Bind, Netapp Cloud Backup, Netapp H300e Firmware, Netapp H300s Firmware and 9 more.
How do I fix CVE-2021-25219?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-25219 being exploited?
There is no known exploitation of CVE-2021-25219 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-25219, ALSA-2022:2092, AZL-6327, CLSA-2021-1635957830, CLSA-2021-1637070791, CLSA-2021-1639681836 and 19 more.