Arch Linux Security Advisory ASA-202110-12 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-25219 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2502 Summary ======= The package bind before version 9.16.22-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.16.22-1. # pacman -Syu "bind>=9.16.22-1" The problem has been fixed upstream in version 9.16.22. Workaround ========== Setting "lame-ttl 0;" in the BIND configuration prevents the performance issue. Description =========== In BIND before version 9.16.22, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing. Impact ====== A malicious DNS client could trigger queries to broken authoritative DNS servers, resulting in high CPU usage and service degradation of the BIND server. References ========== https://kb.isc.org/v1/docs/cve-2021-25219 https://github.com/isc-projects/bind9/commit/8fe18c0566c41228a568157287f5a44... https://security.archlinux.org/CVE-2021-25219