CVE-2022-0635

An assertion check flaw was found in BIND, with a refactoration of RFC 8198 Aggressive Use of the DNSSEC-Validated Cache feature (synth-from-dnssec). The repeated patterns of specific queries to servers with this feature enabled could cause an INSIST failure in query.c:query_dname, which results in unexpected termination. This flaw allows a remote attacker to use a series of specific queries to trigger a failed assertion check that causes the named process to terminate, leading to a denial of service.

The vulnerability affects BIND resolvers running 9.18.0 with both dnssec-validation and synth-from-dnssec enabled. (Note that dnssec-validation auto; is the default setting unless configured otherwise in named.conf and that enabling dnssec-validation automatically enables synth-from-dnssec unless explicitly disabled)

This flaw only affects BIND-9.18.0, whereas Red Hat ships BIND-9.16 and lower versions. Therefore, versions of BIND shipped with Red Hat Products are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.