CVE-2022-38177 — Memory leak in ECDSA DNSSEC verification code

Description

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Affected products

Vendor	Product	Affected	Fixed
ISC	BIND9	Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33, Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	bind9	1:9.17.20-1	—
Debian 13	bind9	1:9.17.20-1	—
Debian 12	bind9	1:9.17.20-1	—
Debian 11	bind9	1:9.16.33-1~deb11u1	DSA-5235-1
Debian 10	bind9	1:9.11.5.P4+dfsg-5.1+deb10u8	DLA-3138-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	bind9	1:9.18.1-1ubuntu1.2	USN-5626-1
Ubuntu 20.04 LTS	bind9	1:9.16.1-0ubuntu2.11	USN-5626-1
Ubuntu 18.04 LTS	bind9	1:9.11.3+dfsg-1ubuntu1.18	USN-5626-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	bind9	1:9.10.3.dfsg.P4-8ubuntu1.19+esm3	USN-5626-2
Ubuntu Pro 14.04 LTS	bind9	1:9.9.5.dfsg-3ubuntu0.19+esm7	USN-5626-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	bind +8	32:9.16.23-1.el9_0.1	RHSA-2022:6763
RHEL 8	bind +16	32:9.11.36-3.el8_6.1	RHSA-2022:6778
RHEL 8	bind9.16 +8	32:9.16.23-0.7.el8_6.1	RHSA-2022:6781
RHEL 7	bind +15	32:9.11.4-26.P2.el7_9.10	RHSA-2022:6765

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhev Hypervisor 4	redhat-virtualization-host +1	4.5.3-202211170828_8.6	RHSA-2022:8598
RHEL 8.4 EUS	bind +16	32:9.11.26-4.el8_4.1	RHSA-2022:6779
RHEL 8.2 EUS	bind +16	32:9.11.13-6.el8_2.4	RHSA-2022:6780
RHEL 8.1 E4S	bind +16	32:9.11.4-26.P2.el8_1.6	RHSA-2022:6764

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	bind +8	32:9.16.23-1.el9_0.1	ALSA-2022:6763
AlmaLinux 8	bind +16	32:9.11.36-3.el8_6.1	ALSA-2022:6778
AlmaLinux 8	bind9.16 +8	32:9.16.23-0.7.el8_6.1	ALSA-2022:6781

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	bind	2:9.16.23-1.el9_0.1	RLSA-2022:6763
Rocky Linux 8	bind	2:9.11.36-3.el8_6.1	RLSA-2022:6778
Rocky Linux 8	bind9.16	2:9.16.23-0.7.el8_6.1	RLSA-2022:6781

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	bind	9.16.6-150300.22.21.2	SUSE-SU-2022:3767-1, SUSE-SU-2022:3682-1
SLES 15 SP3	bind	9.16.6-150300.22.21.2	SUSE-SU-2022:3682-1
SLES 15 SP2	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES 15 SP1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES 15	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1

Show 19 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP5	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLES 12 SP4	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLES 12 SP3	bind	9.9.9P1-63.37.1	SUSE-SU-2022:3500-1
SLES 12 SP2	bind	9.9.9P1-63.37.1	SUSE-SU-2022:3500-1
SLES for SAP 15 SP2	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES for SAP 15 SP1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES for SAP 15	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLES for SAP 12 SP5	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLES for SAP 12 SP4	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SLE HPC 15 SP2	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLE HPC 15 SP1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SLE HPC 15	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE OpenStack Cloud Crowbar 9	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SUSE OpenStack Cloud 9	bind	9.11.22-3.43.1	SUSE-SU-2022:3499-1
SUSE Manager Server 4.1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Manager Retail Branch Server 4.1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Manager Proxy 4.1	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Enterprise Storage 7	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1
SUSE Enterprise Storage 6	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.4	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3767-1, SUSE-SU-2022:3729-1, SUSE-SU-2022:3682-1
openSUSE Leap 15.3	bind	9.16.6-150000.12.63.1	SUSE-SU-2022:3729-1, SUSE-SU-2022:3682-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	bind	9.18.7-r0	—
Alpine v3.23	bind	9.18.7-r0	—
Alpine v3.22	bind	9.18.7-r0	—
Alpine v3.21	bind	9.18.7-r0	—
Alpine v3.20	bind	9.18.7-r0	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	bind	9.18.7-r0	—
Alpine v3.18	bind	9.18.7-r0	—
Alpine v3.17	bind	9.18.7-r0	—
Alpine v3.16	bind	9.16.33-r0	—
Alpine v3.15	bind	9.16.33-r0	—
Alpine v3.14	bind	9.16.33-r0	—
Alpine v3.13	bind	9.16.33-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	bind +16	32:9.16.38-1.amzn2023	ALAS2023-2023-161
Amazon Linux 2	bind +15	32:9.11.4-26.P2.amzn2.13	ALAS2-2023-2001

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 2 (CBL-Mariner)	bind	9.16.33-1	—
Azure Linux 2 (CBL-Mariner)	dhcp	4.4.3-2	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	bind +8	32:9.16.23-1.el9_0.1	ELSA-2022-6763
Oracle Linux 8	bind +16	32:9.11.36-3.el8_6.1	ELSA-2022-6778
Oracle Linux 8	bind9.16 +8	32:9.16.23-0.7.el8_6.1	ELSA-2022-6781
Oracle Linux 7	bind +15	32:9.11.4-26.P2.el7_9.10	ELSA-2022-6765

Advisories 33

ALSA-2022:6763 Important: bind security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:6778 Important: bind security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:6781 Important: bind9.16 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:8598 Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.5.3-1] Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
USN-5626-2 bind9 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
RHSA-2022:6763 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6778 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6781 Red Hat Security Advisory: bind9.16 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6764 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6765 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6779 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2022:6780 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
USN-5626-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-5235-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3138-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2022:6778 Important: bind security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2022:6763 Important: bind security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2022:6781 Important: bind9.16 security update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2022:3682-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3499-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3500-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3729-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3767-1 Recommended update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-1492 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 6, 2026
ICSA-25-105-08 ABB M2M Gateway CISA ICS & IT advisories · Apr 7, 2025
2NGA002579 ABB Arctic communication solution ARM600 Vulnerabilities ABB PSIRT · Apr 7, 2025
ALAS2023-2023-161 Important: bind security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 19, 2023
ALAS2-2023-2001 Important: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 21, 2023
ELSA-2022-6778 Important: bind security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 5, 2022
ELSA-2022-6781 Important: bind9.16 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 5, 2022
ELSA-2022-6763 Important: bind security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 4, 2022
ELSA-2022-6765 Important: bind security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 3, 2022

References

https://kb.isc.org/docs/cve-2022-38177
[oss-security] 20220921 ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178) mailing-list
DSA-5235 vendor-advisory
FEDORA-2022-ef038365de vendor-advisory
FEDORA-2022-8268735e06 vendor-advisory
FEDORA-2022-b197d64471 vendor-advisory
[debian-lts-announce] 20221005 [SECURITY] [DLA 3138-1] bind9 security update mailing-list
GLSA-202210-25 vendor-advisory
https://security.netapp.com/advisory/ntap-20221228-0010/

CNA	v3.1	7.5
EUVD	v3.1	7.5