CVE-2022-38178
Vulnérabilité élevée dans BIND9 (ISC)
CVSS 7.5 · Élevée
EPSS 3.0%
ISC•BIND9•Versions : Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1, Open Source Branch 9.18 9.18.0 through versions before 9.18.7, Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33, Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8, Development Branch 9.19 9.19.0 through versions before 9.19.5, Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13
Description
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Gravité et risque d'exploitation
CVE-2022-38178 obtient un score CVSS de 7.5/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 3.00 %, ce qui la place devant 87.2 % des CVE référencées.
Que faire ?
- Vérifiez si BIND9 (versions Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1, Open Source Branch 9.18 9.18.0 through versions before 9.18.7, Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33, Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8, Development Branch 9.19 9.19.0 through versions before 9.19.5, Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://kb.isc.org/docs/cve-2022-38178
- http://www.openwall.com/lists/oss-security/2022/09/21/3
- https://www.debian.org/security/2022/dsa-5235
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
- https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
- https://security.gentoo.org/glsa/202210-25
- https://security.netapp.com/advisory/ntap-20221228-0009/