Bug 1228257 (CVE-2024-1975) - VUL-0: CVE-2024-1975: bind: SIG(0) can be used to exhaust CPU resources
Summary: VUL-0: CVE-2024-1975: bind: SIG(0) can be used to exhaust CPU resources
Status: NEW
Alias: CVE-2024-1975
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Jorik Cronenberg
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/414981/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-1975:7.5:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-24 06:21 UTC by SMASH SMASH
Modified: 2024-07-25 14:10 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
upstream patch (12.50 KB, patch)
2024-07-24 07:11 UTC, Alexander Bergmann 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-07-24 06:21:43 UTC 
If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.

This issue affects BIND 9 versions:
9.0.0 -> 9.11.37
9.16.0 -> 9.16.50
9.18.0 -> 9.18.27
9.19.0 -> 9.19.24
9.9.3-S1 -> 9.11.37-S1
9.16.8-S1 -> 9.16.49-S1
9.18.11-S1 -> 9.18.27-S1

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1975
https://seclists.org/oss-sec/2024/q3/101
https://kb.isc.org/docs/cve-2024-0760
https://kb.isc.org/docs/cve-2024-4076
https://kb.isc.org/docs/cve-2024-1975
https://kb.isc.org/docs/cve-2024-1737
https://downloads.isc.org/isc/bind9/9.18.28/patches/
http://www.openwall.com/lists/oss-security/2024/07/23/1
https://www.cve.org/CVERecord?id=CVE-2024-1975
https://bugzilla.redhat.com/show_bug.cgi?id=2298901
Comment 1 Alexander Bergmann 2024-07-24 07:11:44 UTC 
Created attachment 876222 [details]
upstream patch

All active code streams, including LTSS, are affected by this issue.