Vulnerabilities > CVE-2022-38177 - Memory Leak vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

NVD

Published: 2022-09-21

Updated: 2023-11-07

Summary

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

Vulnerable Configurations

Part	Description	Count
Application	Isc ISC Bind 9.11.7 ISC Bind 9.11.3 ISC Bind 9.11.6 ISC Bind 9.10.5 ISC Bind 9.11.5 ISC Bind 9.9.3 ISC Bind 9.10.7 ISC Bind 9.11.12 ISC Bind 9.11.8 ISC Bind 9.9.12 ISC Bind 9.9.13 ISC Bind 9.11.21 ISC Bind 9.16.8 ISC Bind 9.16.11 ISC Bind 9.11.27 ISC Bind 9.16.13 ISC Bind 9.11.29 ISC Bind 9.16.21 ISC Bind 9.11.35 ISC Bind 9.11.14-S1 ISC Bind 9.11.19-S1 ISC Bind 9.11.37 ISC Bind 9.16.32 ISC Bind 9.8.4 ISC Bind 9.8.5 ISC Bind 9.8.6 ISC Bind 9.8.7 ISC Bind 9.8.8 ISC Bind 9.11.31 ISC Bind 9.11.36 ISC Bind 9.12.0 ISC Bind 9.16.0 ISC Bind 9.16.12 ISC Bind 9.16.15 ISC Bind 9.16.19 ISC Bind 9.16.22	68
Application	Netapp Netapp Active IQ Unified Manager -	1
OS	Debian Debian Debian Linux 10.0 Debian Debian Linux 11.0	2
OS	Fedoraproject Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37	3

Common Weakness Enumeration (CWE)

CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References