CVE-2024-12705: 
Rocky Linux vulnerability analysis and mitigation

CVE-2024-12705 is a vulnerability affecting BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. The vulnerability was disclosed on January 29, 2025, and involves DNS-over-HTTPS (DoH) functionality where clients can exhaust a DNS resolver's CPU and/or memory resources (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and involves the exploitation of HTTP/2 traffic handling in DNS-over-HTTPS implementations (NVD).

When successfully exploited, this vulnerability can lead to Denial of Service (DoS) conditions by overwhelming the DNS resolver's CPU and/or memory resources through flooding with crafted valid or invalid HTTP/2 traffic (NetApp).

The vulnerability requires no user interaction and can be exploited remotely without authentication. The attack complexity is considered low, making it relatively straightforward to exploit (Ubuntu).

Multiple vendors have released patches to address this vulnerability. Ubuntu has fixed the issue in versions 24.10, 24.04 LTS, 22.04 LTS, and 20.04 LTS with updated packages (Ubuntu).