Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record.
This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.
By sending specific queries to the resolver, an attacker can cause `named` to terminate unexpectedly.
Note that the BIND configuration option `synth-from-dnssec` is enabled by default in all versions of BIND 9.18 and 9.18-S and newer. In earlier versions of BIND that had this option available, it was disabled unless activated explicitly in `named.conf`.
CAPEC ID: N/A
Description: By sending specific queries to the resolver, an attacker can cause `named` to terminate unexpectedly.
Note that the BIND configuration option `synth-from-dnssec` is enabled by default in all versions of BIND 9.18 and 9.18-S and newer. In earlier versions of BIND that had this option available, it was disabled unless activated explicitly in `named.conf`.
Solutions
Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.42-S1 or 9.18.16-S1.
Configurations
Workarounds
Setting `synth-from-dnssec` to `no` prevents the problem.
Exploits
We are not aware of any active exploits.
Credits
ISC would like to thank Greg Kuechle from SaskTel for bringing this vulnerability to our attention.