Cleaning an ECS-enabled cache may cause excessive CPU load
If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance.
This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
By sending specific queries to a resolver, an attacker can degrade `named`'s query-handling performance. In the worst-case scenario, a resolver can become entirely unresponsive.
CAPEC ID: N/A
Description: By sending specific queries to a resolver, an attacker can degrade `named`'s query-handling performance. In the worst-case scenario, a resolver can become entirely unresponsive.
Solutions
Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.48-S1 or 9.18.24-S1.
Configurations
Workarounds
There is no workaround for this issue other than disabling the ECS feature entirely.
Exploits
We are not aware of any active exploits.
Credits
ISC would like to thank Yann Kerherve and Ask Bjørn Hansen for bringing this vulnerability to our attention.