CVE-2022-1183
📋 TL;DR
This vulnerability causes the BIND DNS server to crash with an assertion failure when configured with HTTP references in listen-on statements. It affects BIND servers using DNS over HTTPS (DoH) configurations, potentially causing denial of service. Only BIND 9.18.0-9.18.2 and 9.19.0 are affected.
💻 Affected Systems
- ISC BIND
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
DNS service disruption leading to complete unavailability of DNS resolution for dependent services and applications.
Likely Case
Intermittent DNS server crashes causing temporary service outages until daemon restarts.
If Mitigated
Minimal impact with proper monitoring and automated restart mechanisms in place.
🎯 Exploit Status
The vulnerability can be triggered by normal DNS queries to servers with vulnerable configurations, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: BIND 9.18.3 or later, or 9.19.1 for development branch
Vendor Advisory: https://kb.isc.org/docs/cve-2022-1183
Restart Required: Yes
Instructions:
1. Download and install BIND 9.18.3 or later from ISC. 2. Stop the named service. 3. Install the updated package. 4. Start the named service. 5. Verify the service is running correctly.
🔧 Temporary Workarounds
Remove HTTP references from configuration
allRemove any HTTP references from listen-on statements in named.conf to prevent the assertion failure.
# Edit named.conf and remove HTTP references from listen-on statements
# Example: Change 'listen-on port 853 tls http { any; };' to 'listen-on port 853 tls { any; };'
Disable DoH functionality
allTemporarily disable DNS over HTTPS functionality until patching can be completed.
# Comment out or remove DoH-related configuration lines in named.conf
# Example: Add '#' before 'http' in listen-on statements
🧯 If You Can't Patch
- Implement monitoring and automated restart for named daemon crashes
- Consider using DNS load balancing or redundant DNS servers to maintain service availability
🔍 How to Verify
Check if Vulnerable:
Check BIND version with 'named -v' and examine named.conf for HTTP references in listen-on statements.Check Version:
named -vVerify Fix Applied:
Verify BIND version is 9.18.3+ or 9.19.1+ and test DNS queries to ensure service remains stable.📡 Detection & Monitoring
Log Indicators:
- named daemon crashes with assertion failure messages
- Error logs containing 'assertion failure' related to HTTP handling
Network Indicators:
- Sudden drop in DNS query responses
- Increased TCP RST packets from DNS server
SIEM Query:
source="bind" AND ("assertion failure" OR "named crashed" OR "SIGABRT")