CVE-2025-40777: BIND 9 Denial of Service Vulnerability

CVE-2025-40777 Overview

CVE-2025-40777 is a denial of service vulnerability in ISC BIND 9 DNS server that affects caching resolvers configured with specific stale answer settings. When named is configured with serve-stale-enable yes and stale-answer-client-timeout set to 0, and the resolver processes a query involving a CNAME chain with a specific combination of cached or authoritative records, the daemon will terminate unexpectedly with an assertion failure.

This vulnerability allows remote attackers to cause a denial of service condition by triggering the assertion failure, effectively crashing the DNS resolver and disrupting DNS resolution services for all dependent systems and clients.

Critical Impact

Remote attackers can crash BIND 9 DNS resolvers configured with stale answer features, causing widespread DNS resolution failures across networks relying on the affected resolver.

Affected Products

• BIND 9 versions 9.20.0 through 9.20.10
• BIND 9 versions 9.21.0 through 9.21.9
• BIND 9 versions 9.20.9-S1 through 9.20.10-S1 (Supported Preview Edition)

Discovery Timeline

• 2025-07-16 - CVE-2025-40777 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-40777

Vulnerability Analysis

This vulnerability is classified under CWE-617 (Reachable Assertion), indicating that the BIND 9 daemon contains an assertion check that can be triggered by an attacker through normal network operations. The assertion failure occurs in the query resolution path when processing CNAME chains under specific conditions.

The vulnerability specifically requires a precise configuration combination: the serve-stale feature must be enabled with stale-answer-client-timeout set to 0 (the only non-disabled value allowed). When these conditions are met, certain CNAME chain resolution patterns involving cached or authoritative records can trigger an internal assertion that causes the named process to abort immediately.

The network-accessible nature of this vulnerability means any remote attacker who can send DNS queries to the vulnerable resolver can potentially trigger the crash. No authentication or user interaction is required, making this highly exploitable in exposed DNS infrastructure.

Root Cause

The root cause is a reachable assertion (CWE-617) in the BIND 9 resolver code path that handles CNAME chain resolution when stale answer functionality is active. The assertion check fails when it encounters an unexpected state involving the combination of cached records and authoritative data during CNAME following. The stale-answer-client-timeout 0 setting appears to create a timing or state condition that exposes this code path to malformed or unusual CNAME chains that would otherwise be handled differently.

Attack Vector

The attack leverages the network-accessible DNS query interface. An attacker can craft DNS queries that, when resolved by the vulnerable BIND 9 server, trigger resolution paths involving specific CNAME chain configurations. The attacker does not need direct access to the server—they only need the ability to send DNS queries to the resolver, either directly or through recursive query mechanisms.

The attack can be executed by:

1. Controlling or influencing authoritative DNS servers that the target resolver queries
2. Crafting DNS responses that create the specific CNAME chain pattern
3. Sending queries to the victim resolver that trigger resolution of the malicious CNAME chain

The vulnerability manifests in the CNAME chain processing logic when stale answer handling is active. When a query triggers resolution of a CNAME chain with a specific combination of cached and authoritative records, the internal state validation fails, causing named to abort with an assertion failure. For detailed technical information, refer to the ISC CVE-2025-40777 Advisory.

Detection Methods for CVE-2025-40777

Indicators of Compromise

• Unexpected named process terminations or restarts in system logs
• Assertion failure messages in BIND logs referencing CNAME resolution
• DNS resolution failures reported by clients immediately after successful queries
• Process core dumps containing assertion-related stack traces in the query resolution path

Detection Strategies

• Monitor system logs for named daemon crashes with assertion failure messages
• Implement process monitoring to detect unexpected BIND service restarts
• Review DNS query logs for unusual CNAME-heavy query patterns from external sources
• Configure automated alerting on named process state changes or exit codes

Monitoring Recommendations

• Deploy health checks that verify named process stability and response times
• Monitor DNS query latency spikes that may indicate service instability or restarts
• Track BIND configuration files for changes to serve-stale-enable and stale-answer-client-timeout settings
• Implement redundant DNS infrastructure monitoring to detect single-point failures

How to Mitigate CVE-2025-40777

Immediate Actions Required

• Review BIND configurations for the vulnerable combination of serve-stale-enable yes and stale-answer-client-timeout 0
• Temporarily disable or reconfigure stale answer settings to mitigate the vulnerability
• Apply ISC security patches as soon as they become available for affected versions
• Ensure DNS infrastructure redundancy to maintain service availability during patching

Patch Information

ISC has documented this vulnerability in their knowledge base. Administrators should consult the ISC CVE-2025-40777 Advisory for specific patch information and upgrade guidance. Upgrade to patched versions of BIND 9 beyond 9.20.10, 9.21.9, and 9.20.10-S1 as released by ISC.

Workarounds

• Set stale-answer-client-timeout to disabled instead of 0 to avoid the vulnerable code path
• Disable serve-stale-enable entirely if stale answer functionality is not critical to operations
• Implement rate limiting on DNS queries to reduce the potential impact of exploitation attempts
• Deploy multiple DNS resolvers behind load balancers to maintain availability if one instance crashes

# Configuration example - Disable vulnerable stale answer settings
# In named.conf options block:
options {
    # Disable stale answer client timeout to mitigate CVE-2025-40777
    stale-answer-client-timeout disabled;
    
    # Alternatively, disable serve-stale entirely
    # serve-stale-enable no;
};