Arch Linux Security Advisory ASA-202110-12
=========================================
Severity: Medium
Date    : 2021-10-29
CVE-ID  : CVE-2021-25219
Package : bind
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2502

Summary
======
The package bind before version 9.16.22-1 is vulnerable to denial of
service.

Resolution
=========
Upgrade to 9.16.22-1.

# pacman -Syu "bind>=9.16.22-1"

The problem has been fixed upstream in version 9.16.22.

Workaround
=========
Setting "lame-ttl 0;" in the BIND configuration prevents the
performance issue.

Description
==========
In BIND before version 9.16.22, exploitation of broken authoritative
servers using a flaw in response processing can cause degradation in
BIND resolver performance. The way the lame cache is currently designed
makes it possible for its internal data structures to grow almost
infinitely, which may cause significant delays in client query
processing.

Impact
=====
A malicious DNS client could trigger queries to broken authoritative
DNS servers, resulting in high CPU usage and service degradation of the
BIND server.

References
=========
https://kb.isc.org/v1/docs/cve-2021-25219
https://github.com/isc-projects/bind9/commit/8fe18c0566c41228a568157287f5a44f96d37662
https://security.archlinux.org/CVE-2021-25219