CVE-2023-2911

moderate-risk

Published 2023-06-21

If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.

Do I need to act?

0.18% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (12)

Bind

Debian Linux

Fedora

Active Iq Unified Manager

H700S Firmware

H300S Firmware

H410C Firmware

H410S Firmware

H500S Firmware

Affected Vendors

Debian Isc Fedoraproject Netapp

References (12)

Mailing List http://www.openwall.com/lists/oss-security/2023/06/21/6

Vendor Advisory https://kb.isc.org/docs/cve-2023-2911

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Third Party Advisory https://security.netapp.com/advisory/ntap-20230703-0010/

Third Party Advisory https://www.debian.org/security/2023/dsa-5439

Mailing List http://www.openwall.com/lists/oss-security/2023/06/21/6

Vendor Advisory https://kb.isc.org/docs/cve-2023-2911

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Third Party Advisory https://security.netapp.com/advisory/ntap-20230703-0010/

Third Party Advisory https://www.debian.org/security/2023/dsa-5439

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 17/34 · Moderate