CVE-2021-25218

Vendor solution

Upgrade to the patched release most closely related to your current version of BIND:

BIND 9.16.20 BIND 9.17.17

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

BIND 9.16.20-S1

Red Hat statement

An attacker may abuse the Path MTU discovery (PMTUD) protocol to trick bind into exceeding the interface MTU. Response Rate Limiting (RRL) is not enabled by default for user defined views nor the builtin one, but it is enabled by default for the default builtin CHAOS class view, which bind uses to provide various information. This issue did not affect the versions of bind as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they provide an older version of the code which does not allow to trigger the assertion.

Red Hat mitigation

Disabling RRL in all views, including the builtin CHAOS class view, prevents the faulty assertion from being reached in the vulnerable versions of bind. To do that you can remove `rate-limit` from your named.conf files and provide a replacement for the builtin CHAOS view, like the one below: ``` view override_bind chaos { recursion no; notify no; allow-new-zones no; max-cache-size 2M; zone "version.bind" chaos { type primary; database "_builtin version"; }; zone "hostname.bind" chaos { type primary; database "_builtin hostname"; }; zone "authors.bind" chaos { type primary; database "_builtin authors"; }; zone "id.server" chaos { type primary; database "_builtin id"; }; }; ```