CVE-2022-0396: 
NixOS vulnerability analysis and mitigation

BIND versions 9.16.11 through 9.16.26, 9.17.0 through 9.18.0, and versions 9.16.11-S1 through 9.16.26-S1 of the BIND Supported Preview Edition are affected by a vulnerability where specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection (MITRE CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The issue affects TCP connection handling where certain crafted TCP streams can cause connection slots to remain in CLOSE_WAIT status indefinitely (NetApp Security).

When successfully exploited, this vulnerability can lead to a denial of service condition by consuming TCP connection slots indefinitely, potentially affecting the availability of the BIND service (NetApp Security).

The recommended mitigation is to upgrade to a patched version of BIND. For Fedora users, updates are available through the package management system (Fedora Update). Gentoo users should upgrade to version 9.16.33 or later (Gentoo Security).