CVE-2024-4076

What it actually does

Crafted client queries that combine stale data serving with local authoritative zone lookups trigger an assertion failure, causing the BIND process to terminate.

Why it matters to the business

DNS resolution services become unavailable until the server is restarted, disrupting network connectivity, email, web access, and any applications that rely on name resolution.

How an attack unfolds

An attacker sends a sequence of DNS queries that force the server to serve stale cache data while simultaneously performing lookups against locally hosted authoritative zones, triggering the assertion and crashing the daemon.

How to fix it

Upgrade BIND 9 to a version newer than 9.16.50, 9.18.27, 9.19.24, or the corresponding subscription releases; restart the named process after upgrade and verify resolution functionality.

How to confirm the fix worked

Confirm the installed BIND version is outside the affected ranges, send test queries that previously triggered the condition, and monitor for absence of assertion failures in logs.

Typical attack path

1. Identify an exposed BIND 9 instance running an affected version
2. Send queries that request data known to be in the stale cache
3. Force concurrent lookups into local authoritative zone data
4. Trigger the assertion failure and observe service termination
5. Repeat to maintain denial of service

How to detect it

Search BIND query and general logs for assertion failure messages, unexpected named process restarts, or core dumps occurring shortly after client queries involving both cache and authoritative data.

What your security team should do

• Prioritize upgrade of all internet-facing and internal BIND instances within 30 days given the high CVSS score
• Enable query logging and monitor for repeated stale-cache plus authoritative lookup patterns
• Implement network-level rate limiting on recursive queries from untrusted sources
• Maintain offline backups of named configuration and zone files before applying updates