CVE-2022-2906 Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)
Attackers can cause memory exhaustion in BIND9 via crafted Diffie-Hellman key exchange requests, leading to service crashes and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2906?
CVE-2022-2906 is a high-severity denial of service vulnerability in Isc Bind, published on 21 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
Weakness: CWE-401
Which versions are affected by CVE-2022-2906?
It affects 1 product.
Products include Isc Bind.
How do I fix CVE-2022-2906?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-2906 being exploited?
There is no known exploitation of CVE-2022-2906 in the wild and no public exploit code.
Other vulnerabilities in Isc Bind
Sources
Also known as ALPINE-CVE-2022-2906, DEBIAN-CVE-2022-2906, GHSA-pqxc-54m5-8r8m, UBUNTU-CVE-2022-2906.