Bug 1228258 (CVE-2024-4076)

Summary: VUL-0: CVE-2024-4076: bind: Assertion failure when serving both stale cache data and authoritative zone content
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Jorik Cronenberg <jorik.cronenberg>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P2 - High CC: abergmann
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/414979/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-4076:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: upstream patch

Description SMASH SMASH 2024-07-24 06:21:51 UTC 
Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.

This issue affects BIND 9 versions:
9.16.13 -> 9.16.50
9.18.0 -> 9.18.27
9.19.0 -> 9.19.24
9.11.33-S1 -> 9.11.37-S1
9.16.13-S1 -> 9.16.50-S1
9.18.11-S1 -> 9.18.27-S1

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4076
https://seclists.org/oss-sec/2024/q3/101
https://kb.isc.org/docs/cve-2024-0760
https://kb.isc.org/docs/cve-2024-4076
https://kb.isc.org/docs/cve-2024-1975
https://kb.isc.org/docs/cve-2024-1737
https://downloads.isc.org/isc/bind9/9.18.28/patches/
http://www.openwall.com/lists/oss-security/2024/07/23/1
https://www.cve.org/CVERecord?id=CVE-2024-4076
https://bugzilla.redhat.com/show_bug.cgi?id=2298904
Comment 1 Alexander Bergmann 2024-07-24 07:14:15 UTC 
Created attachment 876223 [details]
upstream patch

All code streams >= SLE-15-SP3 are affected by this issue.