Loading vulnerability…
CPU Exhaustion in BIND 9 Additional-Section Processing
CVE-2024-11187 is a resource-exhaustion vulnerability in BIND 9 authoritative DNS service processing. A deliberately crafted DNS zone can cause certain queries to produce responses containing numerous Additional-section records. Repeated queries for those responses cause disproportionate processing-resource consumption by the authoritative server or an independent resolver. Affected versions are BIND 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and the corresponding supported 9.11-S1, 9.16-S1, and 9.18-S1 release ranges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can exhaust CPU or other processing resources by repeatedly querying a crafted zone, resulting in denial of service for the affected authoritative BIND server. Independent resolvers processing the oversized Additional sections can also consume disproportionate resources and be affected.
If you can’t patch tonight, do this now.
On BIG-IP systems, configure BIND with minimal-responses yes; to limit information included in DNS responses; apply the equivalent setting to externally used DNS servers. Restrict access to zone files and limit zone-editing authority to trusted administrators to reduce the chance that malicious zones can be introduced.
Patch, then assume compromise.
Upgrade BIND or the affected platform package to a vendor-fixed release. For affected F5 BIG-IP branches, upgrade to at least 17.5.1.3 on 17.x, 16.1.6.1 on 16.x, or 15.1.10.8 on 15.x. Where a maintained branch has no fix, upgrade to a branch that includes one.
No public exploits tracked yet. Mallory keeps watching.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.