CVE-2024-1975

What it actually does

A client sending a stream of SIG(0) signed DNS requests against a cached KEY Resource Record from a DNSSEC-signed zone forces the BIND 9 resolver to perform expensive cryptographic validation operations, exhausting CPU resources and causing denial of service.

Why it matters to the business

DNS resolution services become unavailable or severely degraded, disrupting network connectivity, email, web access, and any application that depends on name resolution until the resolver recovers or is restarted.

How an attack unfolds

An attacker locates a vulnerable BIND resolver that has cached a KEY RR from a DNSSEC-signed domain, then transmits a sustained stream of specially crafted SIG(0) signed queries; each request triggers repeated CPU-intensive signature verification, leading to resource exhaustion without authentication.

How to fix it

Upgrade BIND 9 installations to versions after 9.11.37, 9.16.50, 9.18.27, 9.19.24 or the corresponding subscription editions; if immediate upgrade is not possible, restrict exposure of recursive resolvers to untrusted clients and apply query-rate limiting where supported.

How to confirm the fix worked

Confirm the installed BIND version is outside the affected ranges, test that high-volume SIG(0) query streams no longer produce sustained CPU spikes, and review release notes for the applied patch.

Typical attack path

1. Identify a BIND 9 resolver that has cached a KEY RR from a DNSSEC-signed zone
2. Craft and transmit a continuous stream of SIG(0) signed DNS requests
3. Observe progressive CPU exhaustion on the resolver process until service degradation occurs

How to detect it

Examine BIND query logs and system CPU metrics for sustained high volumes of SIG(0) signed requests coinciding with resolver process CPU spikes; correlate with cache entries containing KEY RRs from DNSSEC-signed zones.

• SIG(0) signed query
• KEY RR in cache
• named process high CPU
• excessive signature validation operations

What your security team should do

• Prioritize upgrade of all internet-facing or recursive BIND 9 instances to fixed releases
• Temporarily restrict recursive query access to trusted networks until patches are deployed
• Enable query logging and CPU monitoring on resolvers to detect anomalous SIG(0) traffic patterns
• Review downstream dependents and plan coordinated rollout across the environment