CVE-2023-5517

A flaw was found in the bind package which may result in a Denial of Service in named process. This is a result of a reachable assertion, leading named to prematurely terminate when both conditions are met: nxdomain-redirect for the queried domain is configured and the resolver receives a PTR query, used for a reverse DNS lookup, for a RFC 1918 address that would normally result in an authoritative NXDOMAIN response. A single query matching both conditions can lead to a Denial of Service in the named application.

The vulnerability in the bind package represents a important severity issue due to its potential to cause a Denial of Service (DoS) in the named DNS server. This flaw arises from a reachable assertion that triggers a premature termination of the named process when specific conditions are met: a domain configured with nxdomain-redirect and a PTR query for an RFC 1918 address. This scenario can lead to a complete failure of the DNS resolution service, disrupting network operations and availability. Given that DNS services are fundamental for network communication and resource accessibility, such an exploit could result in significant service outages, impacting both internal and external systems reliant on the affected DNS server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent this vulnerability, ensure the nxdomain-redirect directive is not present in the /etc/named.conf file. Disabling the nxdomain-redirect feature makes the faulty code path impossible to reach, preventing this flaw from being exploitable.