CVE-2020-8622: 
NixOS vulnerability analysis and mitigation

CVE-2020-8622 affects BIND versions 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, and 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition. The vulnerability was discovered by Dave Feldman, Jeff Warren, and Joel Cunningham and disclosed in August 2020 (ISC Advisory).

The vulnerability allows an attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, to send a truncated response to that request, triggering an assertion failure and causing the server to exit. Alternatively, an off-path attacker would need to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger the assertion failure (MITRE CVE). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) (Ubuntu Security).

A successful exploitation of this vulnerability results in a denial of service condition by causing the BIND server to exit due to an assertion failure. This affects the availability of DNS services provided by the affected server (Synology Advisory).

The vulnerability can be exploited in two ways: 1) By an attacker who is on the network path for a TSIG-signed request or operating the receiving server, or 2) By an off-path attacker who can correctly guess the timing and characteristics of TSIG-signed requests. The attack requires low attack complexity but does require low privileges (Red Hat Advisory).

The vulnerability has been fixed in BIND version 9.16.6. Organizations running affected versions should upgrade to the patched version. Multiple vendors have released security updates including Ubuntu, Red Hat, Debian, and others (Debian Advisory, Ubuntu Advisory).