## Summary
BIND 9 contains a remotely triggerable memory leak in the resolver when handling specially crafted domains. Querying the crafted domain can cause unbounded RSS growth and may lead to an out-of-memory condition.
## Technical Details
- Vulnerability class: CWE-772 (Missing Release of Resource after Effective Lifetime)
- Affected component: BIND 9 resolver logic involved in preparing DNSSEC proofs of non-existence (per ISC KB title)
- Trigger: a client sends a DNS query for a specially crafted domain to a BIND resolver
- Fault behavior:
- Memory is not recovered by named, causing unbounded growth of Resident Set Size (RSS)
- During shutdown or reload attempts, named may exit with an assertion failure
- Prerequisites / access:
- Network-accessible resolver; no authentication or user interaction required per CVSS (AV:N/AC:L/PR:N/UI:N)
- Exploit status:
- ISC states no active exploits are known
## Affected
- isc bind 9 resolver versions:
- 9.20.0 through 9.20.20
- 9.21.0 through 9.21.19
- 9.20.9-S1 through 9.20.20-S1
- Not affected:
- 9.18.0 through 9.18.46
- 9.18.11-S1 through 9.18.46-S1
- Note: ISC indicates authoritative services are believed to be unaffected; resolvers are affected.
## Impact
- High availability impact: unbounded RSS growth can lead to an out-of-memory condition
- Service management impact: named may exit with an assertion failure on shutdown/reload
## Mitigation
1. Upgrade BIND 9 to one of the patched releases:
- 9.20.21
- 9.21.20
- 9.20.21-S1 (preview branch)
2. If upgrading is not immediately possible, treat exposed recursive resolver endpoints as high risk (no ISC workaround is known).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772