CVE-2022-1183 Destroying a TLS session early causes assertion failure

High 7.5 Published 19 May 2022 Updated 17 Sep 2024

Attackers can cause a denial of service in BIND DNS servers configured for DNS over HTTPS by triggering an assertion failure during TLS session termination.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-1183?

CVE-2022-1183 is a high-severity denial of service vulnerability in Isc Bind, published on 19 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.

Weakness: CWE-617

Which versions are affected by CVE-2022-1183?

It affects 6 products.

Linux distribution packages (1)

bind openSUSE:Tumbleweed All versions 9.18.3-1.1

Products include Isc Bind, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware, Netapp H500s Firmware, Netapp H700s Firmware.

How do I fix CVE-2022-1183?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-1183 being exploited?

There is no known exploitation of CVE-2022-1183 in the wild and no public exploit code.

All Isc Bind vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-1183, GHSA-wgcp-6p65-qv57, UBUNTU-CVE-2022-1183, USN-5429-1, openSUSE-SU-2024:12129-1.