Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-1975
CVE-2024-1975:
Rocky Linux vulnerability analysis and mitigation
Overview
CVE-2024-1975 is a vulnerability in BIND 9 that affects versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, and various S1 versions. The vulnerability allows a malicious client to exhaust resolver CPU resources by sending a stream of SIG(0) signed requests when a server hosts a zone containing a 'KEY' Resource Record or when a resolver DNSSEC-validates a 'KEY' Resource Record from a DNSSEC-signed domain in cache (ISC KB).
Technical details
The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high availability impact while not affecting confidentiality or integrity (NVD). The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
Impact
The primary impact of this vulnerability is on system availability through CPU resource exhaustion. For systems running BIND 9.18 series, the fix involves the complete removal of SIG(0) dynamic DNS update support, rather than implementing a mitigation, with the actual fix only available in the 9.20 series (OSS Security).
Mitigation and workarounds
Multiple vendors have released patches to address this vulnerability. For BIND 9.18 series, the mitigation involves the complete removal of SIG(0) dynamic DNS update support. Users can find individual vulnerability-specific patches in the 'patches' subdirectory of each published release directory (OSS Security). For those who require SIG(0) support, upgrading to BIND 9.20 series is recommended as it contains the actual fix rather than feature removal.
Community reactions
The vulnerability disclosure has led to discussions in the security community, particularly regarding the drastic approach taken in the 9.18 series where SIG(0) support was completely removed rather than implementing a proper fix. This decision has been noted as being particularly impactful for Debian 12 installations (OSS Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management