CVE-2022-3924
published 2023-01-26CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value…
PriorityP351high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
15.99%
96.5th percentile
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.
If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.
This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bind9 | < bind9 1:9.18.11-1 (bookworm) | bind9 1:9.18.11-1 (bookworm) |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | >= 0 < 9.16.37-r0 | 9.16.37-r0 |
| isc | bind | >= 0 < 9.16.37-r0 | 9.16.37-r0 |
| isc | bind | >= 0 < 9.16.37-r0 | 9.16.37-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 0 < 9.18.11-r0 | 9.18.11-r0 |
| isc | bind | >= 9.16.12 < 9.16.37 | 9.16.37 |
| isc | bind | >= 9.18.0 < 9.18.11 | 9.18.11 |
| isc | bind | >= 9.19.0 < 9.19.9 | 9.19.9 |
| isc | bind9 | >= 0 < 1:9.16.37-1~deb11u1 | 1:9.16.37-1~deb11u1 |
| isc | bind9 | >= 0 < 1:9.18.11-1 | 1:9.18.11-1 |
| isc | bind9 | >= 0 < 1:9.18.11-1 | 1:9.18.11-1 |
| isc | bind9 | >= 0 < 1:9.18.11-1 | 1:9.18.11-1 |
| isc | bind9 | >= 0 < 1:9.16.1-0ubuntu2.12 | 1:9.16.1-0ubuntu2.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2023-01-25·CVSS 7.5
CVE-2022-3094 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Rob Schulhof discovered that Bind incorrectly handled a large number of
UPDATE messages. A remote attacker could possibly use this issue to cause
Bind to consume resources, resulting in a denial of service.
(CVE-2022-3094)
Borja Marcos discovered that Bind incorrectly handled certain RRSIG
queries. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service. This issue only affected Ubuntu
22.04 LTS and Ubuntu 22.10. (CVE-2022-3736)
Maksym Odinintsev discovered that Bind incorrectly handled certain answers
from stale cache. A remote attacker could possibly use this issue to cause
Bind to crash, resulting in a denial of service. This issue only affected
Ubuntu 22
Red Hat
bind: sending specific queries to the resolver may cause a DoS
vendor_redhat·2023-01-25·CVSS 7.5
CVE-2022-3924 [HIGH] CWE-20 bind: sending specific queries to the resolver may cause a DoS
bind: sending specific queries to the resolver may cause a DoS
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.
If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.
This issue
Microsoft
named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
vendor_msrc·2023-01-10·CVSS 7.5
CVE-2022-3924 [HIGH] CWE-617 named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
isc: isc
Customer Action Required: Yes
Remediation: CBL
Debian
CVE-2022-3924: bind9 - This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also...
vendor_debian·2022·CVSS 7.5
CVE-2022-3924 [HIGH] CVE-2022-3924: bind9 - This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also...
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through
OSV
CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with
osv·2023-01-26·CVSS 7.5
CVE-2022-3924 [HIGH] CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.
If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.
This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through
GHSA
GHSA-29px-hvx8-j7xf: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with
ghsa_unreviewed·2023-01-26
CVE-2022-3924 [HIGH] CWE-617 GHSA-29px-hvx8-j7xf: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through
OSV
CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with
osv·2023-01-26·CVSS 7.5
CVE-2022-3924 [HIGH] CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through
OSV
bind9 vulnerabilities
osv·2023-01-25·CVSS 7.5
CVE-2022-3094 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Rob Schulhof discovered that Bind incorrectly handled a large number of
UPDATE messages. A remote attacker could possibly use this issue to cause
Bind to consume resources, resulting in a denial of service.
(CVE-2022-3094)
Borja Marcos discovered that Bind incorrectly handled certain RRSIG
queries. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service. This issue only affected Ubuntu
22.04 LTS and Ubuntu 22.10. (CVE-2022-3736)
Maksym Odinintsev discovered that Bind incorrectly handled certain answers
from stale cache. A remote attacker could possibly use this issue to cause
Bind to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3924)
No detection rules found.
No public exploits indexed.
Checkpoint
30th January – Threat Intelligence Report
blogs_checkpoint·2023-01-30
CVE-2022-3094 30th January – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 30th January – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 30th January, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHE
The ALPHV/BlackCat Ransomware group has allegedly hacked Westmont Hospitality Group, one of the largest privately-held hospitality businesses in the world. They claim to have obtained access to 262GB of the company’s data.
Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.W
arXiv
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
arxiv_fulltext·2023-10-04
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
https://faculty.sites.uci.edu/zhouli/research/ Qifan Zhang ,
https://faculty.sites.uci.edu/zhouli/research/ Xuesong Bai ,
https://netsec.ccert.edu.cn/people/lx19 Xiang Li ,
https://netsec.ccert.edu.cn/people/duanhx/ Haixin Duan ,
https://netsec.ccert.edu.cn/people/qli/ Qi Li , and
https://faculty.sites.uci.edu/zhouli/ Zhou Li
Corresponding authors. Most of Xiang Li's work was done when visiting UCI as a project specialist.
https://uci.edu/University of California, Irvine,
https://www.tsinghua.edu.cn/en/Tsinghua University
Zhongguancun Laboratory,
https://www.qcl.edu.cn/Quan Cheng Laboratory
## Abstract
Domain Name System (DNS) is a critical component of the Internet. DNS resolvers, which act as the cache
2023-01-26
Published