Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 820563 (CVE-2021-25219) - <net-dns/bind-9.16.22: Lame cache can be abused to severely degrade resolver performance (CVE-2021-25219)
Summary: <net-dns/bind-9.16.22: Lame cache can be abused to severely degrade resolver ...
Alias: CVE-2021-25219
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [glsa? cleanup]
Depends on: 822168 829473
  Show dependency tree
Reported: 2021-10-28 01:39 UTC by Sam James
Modified: 2021-12-17 14:23 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-10-28 01:39:25 UTC
Exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

The purpose of a resolver's lame cache is to ensure that if an authoritative server responds to a resolver's query in a specific broken way, subsequent client queries for the same <QNAME, QTYPE> tuple do not trigger further queries to the same server for a configurable amount of time. The lame cache is enabled by setting the lame-ttl option in named.conf to a value greater than 0. That option is set to lame-ttl 600; in the default configuration, which means the lame cache is enabled by default.


Authoritative-only BIND 9 servers are NOT vulnerable to this flaw.

A successful attack exploiting this flaw causes a named resolver to spend most of its CPU time on managing and checking the lame cache. This results in client queries being responded to with large delays, and increased likelihood of DNS timeouts on client hosts.
Comment 1 Larry the Git Cow gentoo-dev 2021-10-28 02:01:56 UTC
The bug has been referenced in the following commit(s):

commit 4ef29a2c6d73b51b46325a4070a79d4c4daaa969
Author:     Sam James <>
AuthorDate: 2021-10-28 02:01:07 +0000
Commit:     Sam James <>
CommitDate: 2021-10-28 02:01:39 +0000

    net-dns/bind-tools: add 9.16.22 (security bump)
    Signed-off-by: Sam James <>

 net-dns/bind-tools/Manifest                  |   1 +
 net-dns/bind-tools/bind-tools-9.16.22.ebuild | 148 +++++++++++++++++++++++++++
 2 files changed, 149 insertions(+)

commit 7916382847660dca423c35c199bbab7f2b5576c4
Author:     Sam James <>
AuthorDate: 2021-10-28 01:58:50 +0000
Commit:     Sam James <>
CommitDate: 2021-10-28 02:01:38 +0000

    net-dns/bind: add 9.16.22 (security bump)
    Signed-off-by: Sam James <>

 net-dns/bind/Manifest            |   1 +
 net-dns/bind/bind-9.16.22.ebuild | 373 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 374 insertions(+)
Comment 2 John Helmert III gentoo-dev Security 2021-11-10 12:40:46 UTC
Please cleanup.