named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-617.
Summary
Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ISC | BIND 9 | 9.11.4-S1 – 9.11.37-S1; 9.16.8-S1 – 9.16.36-S1 | — | No fix listed | CNA |
- BIND 9 VendorISC Affected 9.11.4-S1 – 9.11.37-S1; 9.16.8-S1 – 9.16.36-S1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:* | 9.11.4 s1 | Vulnerable | ISC |
| cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:* | 9.11.37 s1 | Vulnerable | ISC |
| cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:* | 9.16.8 s1 | Vulnerable | ISC |
| cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:* | 9.16.36 s1 | Vulnerable | ISC |
- cpe:2.3:a:isc:bind:9.11.4:s1:*:*:supported_preview:*:*:* Versions 9.11.4 s1 Vulnerable ·ISC
- cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:* Versions 9.11.37 s1 Vulnerable ·ISC
- cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:* Versions 9.16.8 s1 Vulnerable ·ISC
- cpe:2.3:a:isc:bind:9.16.36:s1:*:*:supported_preview:*:*:* Versions 9.16.36 s1 Vulnerable ·ISC
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3488
- 2026-10-03 Alias added: GHSA-pq6j-95q4-4mhj
References
Advisory 1
More ISC Bind vulnerabilities
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
- TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
- TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
- TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
- TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
Sources
- CVE-2022-3488 · CVE Program
- CVE-2022-3488 · NVD
- FIRST EPSS
- GHSA-pq6j-95q4-4mhj · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3488 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences