Bug 1219851 (CVE-2023-4408)

Summary:	VUL-0: CVE-2023-4408: bind: Parsing large DNS messages may cause excessive CPU load
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Thomas Leroy <thomas.leroy>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	abergmann, galaxy-bugs, jorik.cronenberg, max, meissner, stoyan.manolov
Version:	unspecified	Flags:	max: needinfo? (stoyan.manolov)
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/393720/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-4408:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Thomas Leroy 2024-02-12 17:06:43 UTC

New releases of BIND 9 and patches for these vulnerabilities are available via:

- 9.16.48: https://downloads.isc.org/isc/bind9/private/c1872fb63248b757
- 9.18.24: https://downloads.isc.org/isc/bind9/private/c791cb32069dbfb6
- 9.19.21: https://downloads.isc.org/isc/bind9/private/0d0cabccc9841cdd

CVE: CVE-2023-4408

Title: Parsing large DNS messages may cause excessive CPU load

Document version: 1.3

Posting date: 13 February 2024

Program impacted: BIND 9

Versions affected:

BIND

- 9.0.0 -> 9.16.45
- 9.18.0 -> 9.18.21
- 9.19.0 -> 9.19.19

(Versions prior to 9.11.37 were not assessed.)

BIND Supported Preview Edition

- 9.9.3-S1 -> 9.11.37-S1
- 9.16.8-S1 -> 9.16.45-S1
- 9.18.11-S1 -> 9.18.21-S1

(Versions prior to 9.11.37-S1 were not assessed.)

Severity: High

Exploitable: Remotely

Description:

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.

Impact:

By flooding the target server with queries exploiting this flaw an attacker can significantly impair the server’s performance, effectively denying legitimate clients access to the DNS resolution service.

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1.

Workarounds:

No workarounds known.

Active exploits:

We are not aware of any active exploits.

Solution:

Upgrade to the patched release most closely related to your current version of BIND 9:

- 9.16.48
- 9.18.24
- 9.19.21

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

- 9.16.48-S1
- 9.18.24-S1

Acknowledgments:

ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to our attention.

Document revision history:

- 1.0 Early Notification, 10 January 2024
- 1.1 Early fix withdrawn due to regression, 11 January 2024
- 1.2 Revised Early Notification, 15 January 2024
- 1.3 Revised the list of fixed versions, 11 February 2024

Related documents:

See our BIND 9 Security Vulnerability Matrix for a complete listing of security vulnerabilities and versions affected.

Do you still have questions? Questions regarding this advisory should be mailed to bind-security@isc.org or posted as confidential GitLab issues at https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue%5Bconfidential%5D=true.

Note:

ISC patches only currently supported versions. When possible we indicate EOL versions affected. For current information on which versions are actively supported, please see https://www.isc.org/download/.

ISC Security Vulnerability Disclosure Policy:

Details of our current security advisory policy and practice can be found in the ISC Software Defect and Security Vulnerability Disclosure Policy at https://kb.isc.org/docs/aa-00861.

The Knowledgebase article https://kb.isc.org/docs/cve-2023-4408 is the complete and official security advisory document.

Legal Disclaimer:

Internet Systems Consortium (ISC) is providing this notice on an “AS IS” basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this notice at any time. A stand-alone copy or paraphrase of the text of this document that omits the document URL is an uncontrolled copy. Uncontrolled copies may lack important information, be out of date, or contain factual errors.

Comment 3 Marcus Meissner 2024-02-13 14:31:30 UTC

https://downloads.isc.org/isc/bind9/9.18.24/doc/arm/html/notes.html#security-fixes

is public

Comment 4 OBSbugzilla Bot 2024-02-13 17:05:04 UTC

This is an autogenerated message for OBS integration:
This bug (1219851) was mentioned in
https://build.opensuse.org/request/show/1146454 Factory / bind

Comment 6 Thomas Leroy 2024-02-14 08:42:53 UTC

Affected:

- SUSE:ALP:Source:Standard:1.0
- SUSE:SLE-11-SP2:Update
- SUSE:SLE-12-SP1:Update
- SUSE:SLE-12-SP4:Update
- SUSE:SLE-15-SP3:Update
- SUSE:SLE-15-SP4:Update
- SUSE:SLE-15-SP5:Update
- SUSE:SLE-15:Update
- SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update

Comment 7 Thomas Leroy 2024-02-14 08:58:21 UTC

(In reply to Thomas Leroy from comment #6)
> Affected:
> 
> - SUSE:ALP:Source:Standard:1.0
> - SUSE:SLE-11-SP2:Update
> - SUSE:SLE-12-SP1:Update
> - SUSE:SLE-12-SP4:Update
> - SUSE:SLE-15-SP3:Update
> - SUSE:SLE-15-SP4:Update
> - SUSE:SLE-15-SP5:Update
> - SUSE:SLE-15:Update
> - SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update

Please also consider SUSE:SLE-15-SP6:GA

Comment 10 Maintenance Automation 2024-02-21 12:30:20 UTC

SUSE-SU-2024:0574-1: An update that solves six vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219853, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-5679, CVE-2023-6516
Sources used:
openSUSE Leap 15.5 (src): bind-9.16.48-150500.8.16.1
Basesystem Module 15-SP5 (src): bind-9.16.48-150500.8.16.1
Server Applications Module 15-SP5 (src): bind-9.16.48-150500.8.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Maintenance Automation 2024-02-22 16:30:13 UTC

SUSE-SU-2024:0590-1: An update that solves six vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219853, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-5679, CVE-2023-6516
Sources used:
openSUSE Leap 15.4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): bind-9.16.48-150400.5.40.1
SUSE Manager Proxy 4.3 (src): bind-9.16.48-150400.5.40.1
SUSE Manager Retail Branch Server 4.3 (src): bind-9.16.48-150400.5.40.1
SUSE Manager Server 4.3 (src): bind-9.16.48-150400.5.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Marcus Meissner 2024-04-12 13:20:35 UTC

- SUSE:SLE-15-SP3:Update
- SUSE:SLE-15:Update

still needs submits.

Comment 18 Maintenance Automation 2024-06-03 08:30:06 UTC

SUSE-SU-2024:1894-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868
Maintenance Incident: [SUSE:Maintenance:34020](https://smelt.suse.de/incident/34020/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 bind-9.11.22-3.52.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 bind-9.11.22-3.52.1
SUSE Linux Enterprise Server 12 SP5 (src):
 bind-9.11.22-3.52.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 bind-9.11.22-3.52.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Maintenance Automation 2024-06-11 12:31:00 UTC

SUSE-SU-2024:1982-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-6516
Maintenance Incident: [SUSE:Maintenance:34202](https://smelt.suse.de/incident/34202/)
Sources used:
SUSE Enterprise Storage 7.1 (src):
 bind-9.16.6-150300.22.44.1
openSUSE Leap 15.3 (src):
 bind-9.16.6-150300.22.44.1
Basesystem Module 15-SP6 (src):
 bind-9.16.6-150300.22.44.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 bind-9.16.6-150300.22.44.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 bind-9.16.6-150300.22.44.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 bind-9.16.6-150300.22.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Maintenance Automation 2024-06-17 08:30:34 UTC

SUSE-SU-2024:2033-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1219823, 1219826, 1219851, 1219852, 1219854
CVE References: CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-6516
Maintenance Incident: [SUSE:Maintenance:34201](https://smelt.suse.de/incident/34201/)
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2
SUSE Manager Client Tools for SLE Micro 5 (src):
 libuv-1.18.0-150000.3.2.1, bind-9.16.6-150000.12.74.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.