CVE-2024-11187: BIND 9 DNS DoS Vulnerability

CVE-2024-11187 Overview

CVE-2024-11187 is a resource exhaustion vulnerability in ISC BIND 9, one of the most widely deployed DNS server software packages. The vulnerability allows attackers to construct specially crafted DNS zones that generate responses containing numerous records in the Additional section. When an attacker sends many queries targeting such zones, it forces either the authoritative DNS server or an independent resolver to consume disproportionate computational resources processing these queries, leading to a denial of service condition.

Critical Impact

This vulnerability enables network-based denial of service attacks against DNS infrastructure without requiring authentication, potentially disrupting name resolution services for entire networks or organizations.

Affected Products

• BIND 9 versions 9.11.0 through 9.11.37
• BIND 9 versions 9.16.0 through 9.16.50
• BIND 9 versions 9.18.0 through 9.18.32
• BIND 9 versions 9.20.0 through 9.20.4
• BIND 9 versions 9.21.0 through 9.21.3
• BIND 9 Supported Preview Edition versions 9.11.3-S1 through 9.11.37-S1
• BIND 9 Supported Preview Edition versions 9.16.8-S1 through 9.16.50-S1
• BIND 9 Supported Preview Edition versions 9.18.11-S1 through 9.18.32-S1

Discovery Timeline

• 2025-01-29 - CVE-2024-11187 published to NVD
• 2025-02-11 - Last updated in NVD database

Technical Details for CVE-2024-11187

Vulnerability Analysis

This vulnerability is classified under CWE-405 (Asymmetric Resource Consumption - Amplification), which describes scenarios where an attacker can trigger resource-intensive operations with minimal effort. In the context of BIND 9, the vulnerability manifests when processing DNS queries against deliberately crafted zones.

DNS responses can include an Additional section containing supplementary records that may be useful for the querying client. The vulnerability allows zones to be constructed in a way that causes queries to generate responses with an excessive number of records in this Additional section. The asymmetry between the small query size and the large response processing requirement creates an amplification effect that attackers can leverage.

Root Cause

The root cause stems from insufficient controls on the generation of Additional section records in DNS responses. When BIND 9 processes certain queries against maliciously crafted zones, the server does not adequately limit the computational resources allocated to generating and processing the Additional section content. This allows an attacker who controls a zone (or can induce queries to a malicious zone) to cause resource exhaustion on target DNS infrastructure.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following general approach:

1. The attacker creates or controls a DNS zone specifically crafted to trigger excessive Additional section record generation
2. The attacker sends numerous queries to either an authoritative server hosting the malicious zone or induces a resolver to query the malicious zone
3. Each query forces the DNS server to expend disproportionate CPU and memory resources processing the response
4. Sustained query volume leads to service degradation or complete denial of service

The vulnerability typically requires zones to be deliberately crafted to exploit this weakness. However, in scenarios where attackers can register domains or control zone data, this attack becomes practically exploitable. See the ISC CVE-2024-11187 Advisory for detailed technical information.

Detection Methods for CVE-2024-11187

Indicators of Compromise

• Unusual spikes in DNS query volume targeting specific zones or domains
• Elevated CPU and memory utilization on DNS servers without corresponding legitimate traffic increase
• DNS response times degrading significantly across the infrastructure
• Large DNS responses with abnormally populated Additional sections in packet captures

Detection Strategies

• Monitor DNS server resource utilization (CPU, memory, network I/O) for anomalous patterns
• Implement DNS query logging and analyze for repetitive queries to suspicious domains
• Deploy network-based intrusion detection systems with rules to identify DNS amplification patterns
• Use DNS analytics tools to identify zones generating unusually large responses

Monitoring Recommendations

• Establish baseline metrics for DNS server performance and alert on significant deviations
• Configure SNMP or similar monitoring for real-time DNS server health visibility
• Implement rate limiting and response rate limiting (RRL) monitoring on DNS servers
• Review DNS query logs periodically for patterns indicative of reconnaissance or attack activity

How to Mitigate CVE-2024-11187

Immediate Actions Required

• Identify all BIND 9 instances in your environment and determine their versions
• Prioritize patching internet-facing authoritative DNS servers and public resolvers
• Implement rate limiting on DNS servers as a temporary protective measure
• Review DNS zone configurations for any suspicious or overly complex record structures

Patch Information

ISC has released patches addressing CVE-2024-11187 across all affected BIND 9 version branches. Organizations should upgrade to the latest patched versions as specified in the ISC CVE-2024-11187 Advisory. Debian users should refer to the Debian LTS Announcement for distribution-specific update instructions. NetApp customers should consult the NetApp Security Advisory NTAP-20250207-0002 for affected products and remediation guidance.

Workarounds

• Enable Response Rate Limiting (RRL) on authoritative DNS servers to mitigate query floods
• Implement access control lists (ACLs) to restrict recursive queries to trusted clients only
• Deploy DNS firewalls or filtering proxies to inspect and limit suspicious DNS traffic
• Consider using separate DNS servers for authoritative and recursive services to limit blast radius

# Example BIND configuration to enable Response Rate Limiting
# Add to named.conf options block
options {
    rate-limit {
        responses-per-second 10;
        window 5;
        slip 2;
        log-only no;
    };
};