CVE-2024-1975: BIND 9 DNS DoS Vulnerability

CVE-2024-1975 Overview

CVE-2024-1975 is a resource exhaustion vulnerability affecting ISC BIND 9, one of the most widely deployed DNS server implementations. The vulnerability allows remote attackers to exhaust resolver CPU resources by sending a stream of SIG(0) signed requests when the server hosts a zone containing a "KEY" Resource Record, or when a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache.

This denial of service vulnerability stems from improper resource allocation controls (CWE-770) in the processing of cryptographic signature verification operations. An unauthenticated remote attacker can exploit this flaw to cause significant CPU resource consumption, potentially rendering DNS resolution services unavailable.

Critical Impact

Remote attackers can cause denial of service conditions on BIND 9 DNS servers by exhausting CPU resources through malicious SIG(0) signed request streams, disrupting critical DNS infrastructure.

Affected Products

• BIND 9 versions 9.0.0 through 9.11.37
• BIND 9 versions 9.16.0 through 9.16.50
• BIND 9 versions 9.18.0 through 9.18.27
• BIND 9 versions 9.19.0 through 9.19.24
• BIND 9 Supported Preview Edition versions 9.9.3-S1 through 9.11.37-S1
• BIND 9 Supported Preview Edition versions 9.16.8-S1 through 9.16.49-S1
• BIND 9 Supported Preview Edition versions 9.18.11-S1 through 9.18.27-S1

Discovery Timeline

• July 23, 2024 - CVE-2024-1975 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-1975

Vulnerability Analysis

This vulnerability exists in the SIG(0) signature verification mechanism within BIND 9's DNS processing logic. SIG(0) is a DNS protocol extension that provides transaction authentication using public key cryptography. When a BIND 9 server or resolver has access to KEY Resource Records—either by hosting a zone containing them or by caching DNSSEC-validated KEY records—the server will attempt to verify SIG(0) signatures on incoming requests.

The core issue lies in the computational cost of cryptographic signature verification operations. Each SIG(0) signed request triggers CPU-intensive verification processes. By flooding a vulnerable server with numerous SIG(0) signed requests, an attacker can consume excessive CPU cycles, degrading performance for legitimate DNS queries and potentially causing complete service disruption.

The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the affected BIND versions lack adequate rate limiting or resource management controls for SIG(0) verification operations.

Root Cause

The root cause of CVE-2024-1975 is insufficient resource allocation controls in the SIG(0) signature verification code path. BIND 9 does not implement proper throttling mechanisms to limit the rate at which SIG(0) verification operations are processed. This allows attackers to overwhelm the resolver with verification requests, each consuming significant CPU resources for cryptographic operations. The vulnerability is triggered when KEY Resource Records are available, either through zone hosting or DNSSEC cache population, enabling the signature verification pathway.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a BIND 9 server that hosts zones containing KEY Resource Records or caches DNSSEC-validated KEY records
2. Crafting DNS requests with SIG(0) signatures referencing the available KEY records
3. Sending a high volume of these signed requests to the target server
4. The server attempts to verify each signature, consuming CPU resources
5. Sustained attack traffic exhausts CPU capacity, causing denial of service

The attack can be launched remotely from any network location that can reach the target DNS server. The vulnerability enables algorithmic complexity attacks where the computational cost of processing malicious requests far exceeds the cost of generating them.

Detection Methods for CVE-2024-1975

Indicators of Compromise

• Unusual spikes in DNS query volume, particularly requests containing SIG(0) signatures
• Elevated CPU utilization on BIND 9 servers without corresponding legitimate traffic increases
• Increased DNS resolution latency or timeout errors reported by clients
• Log entries indicating high volumes of signature verification operations
• Network traffic analysis showing repetitive DNS queries from specific source IP addresses

Detection Strategies

• Monitor CPU utilization metrics on DNS servers and alert on sustained elevated usage
• Implement network intrusion detection rules to identify anomalous SIG(0) signed DNS traffic patterns
• Deploy DNS query logging and analyze for unusual request patterns targeting KEY records
• Use SIEM correlation rules to detect relationships between traffic spikes and performance degradation
• Configure rate limiting alerts on DNS server interfaces

Monitoring Recommendations

• Establish baseline CPU utilization patterns for DNS servers and configure alerts for deviations
• Implement deep packet inspection for DNS traffic to identify SIG(0) signature verification abuse
• Monitor DNS server response times and availability through synthetic monitoring
• Review BIND query logs regularly for patterns consistent with exploitation attempts
• Deploy network flow analysis to identify potential attack traffic sources

How to Mitigate CVE-2024-1975

Immediate Actions Required

• Upgrade BIND 9 to patched versions: 9.18.28, 9.20.0, or later stable releases
• If immediate patching is not possible, implement network-level rate limiting for DNS traffic
• Review DNS server configurations to identify zones containing KEY Resource Records
• Consider temporarily removing unnecessary KEY records if feasible without disrupting DNSSEC operations
• Deploy upstream network filtering to limit DNS query rates from individual sources

Patch Information

ISC has released security updates to address this vulnerability. Organizations should upgrade to the latest patched versions of BIND 9. Detailed patch information and updated software packages are available from the ISC CVE-2024-1975 Information page. Additional vendor-specific guidance is available in the NetApp Security Advisory NTAP-20240731-0002 for NetApp products incorporating BIND 9.

Security advisories have also been published on the OpenWall OSS Security mailing list with additional technical context and coordination details.

Workarounds

• Implement aggressive rate limiting on DNS server interfaces to reduce the impact of flooding attacks
• Deploy DNS firewalls or response rate limiting (RRL) to mitigate query flooding
• Configure network-level access controls to restrict DNS queries to trusted sources where possible
• Consider deploying multiple DNS server instances behind load balancers to distribute attack traffic
• Monitor and block source IP addresses exhibiting attack patterns

# Example rate limiting configuration for iptables
# Limit DNS queries per source IP to mitigate flooding attacks
iptables -A INPUT -p udp --dport 53 -m hashlimit \
  --hashlimit-name dns_limit \
  --hashlimit-above 50/sec \
  --hashlimit-mode srcip \
  --hashlimit-burst 100 \
  -j DROP

# Apply similar rule for TCP DNS traffic
iptables -A INPUT -p tcp --dport 53 -m hashlimit \
  --hashlimit-name dns_tcp_limit \
  --hashlimit-above 20/sec \
  --hashlimit-mode srcip \
  --hashlimit-burst 50 \
  -j DROP