CVE-2022-0396 — DoS from specifically crafted TCP packets

Back Back to CVE browser

MEDIUM

DoS from specifically crafted TCP packets

Published Mar 23, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 2.70%

Description

BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.

Affected products

Vendor ISC Product BIND Default
n/a
- Version
  Development Branch 9.17 BIND 9.17 all versions
  Status
  affected
  Constraints
  -
- Version
  Open Source Branch 9.16 9.16.11 through versions before 9.16.27
  Status
  affected
  Constraints
  -
- Version
  Open Source Branch 9.18 9.18.0
  Status
  affected
  Constraints
  -
- Version
  Supported Preview Branch 9.16-S 9.16.11-S through versions before 9.16.27-S
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ISC

BIND

n/a

Version	Status	Constraints
Development Branch 9.17 BIND 9.17 all versions	affected	-
Open Source Branch 9.16 9.16.11 through versions before 9.16.27	affected	-
Open Source Branch 9.18 9.18.0	affected	-
Supported Preview Branch 9.16-S 9.16.11-S through versions before 9.16.27-S	affected	-

Red Hat Enterprise Linux 8

bind9.16-32:9.16.23-0.9.el8.1

Fixed · RHSA-2022:7643
Red Hat Enterprise Linux 9

bind-32:9.16.23-5.el9_1

Fixed · RHSA-2022:8068
Red Hat Enterprise Linux 6

bind

Not affected
Red Hat Enterprise Linux 7

bind

Not affected
Red Hat Enterprise Linux 8

bind

Not affected
Red Hat Enterprise Linux 9

dhcp

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	bind9.16-32:9.16.23-0.9.el8.1	Fixed	RHSA-2022:7643
Red Hat Enterprise Linux 9	bind-32:9.16.23-5.el9_1	Fixed	RHSA-2022:8068
Red Hat Enterprise Linux 6	bind	Not affected	n/a
Red Hat Enterprise Linux 7	bind	Not affected	n/a
Red Hat Enterprise Linux 8	bind	Not affected	n/a
Red Hat Enterprise Linux 9	dhcp	Not affected	n/a

Remediation

Vendor solution

Upgrade to the patched release most closely related to your current version of BIND: 9.16.27 9.18.1 BIND Supported Preview Edition is a special feature-preview branch of BIND provided to eligible ISC support customers. 9.16.27-S1

Red Hat statement

This issue can only be triggered on BIND servers that have the keep-response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block; any hosts which are specified within it will be able to trigger this issue on affected versions. Only the BIND9.16 package in RHEL-8 and the BIND package in RHEL-9 are affected, because of the presence of vulnerable code in our codebase.

Red Hat mitigation

To mitigate this issue in all affected versions of BIND, use the default setting of : ~~~ keep-response-order { none; } ~~~

Metrics

2.70% 0.02703

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02703

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (18 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.70% (0.02703)	85.42th	v5 (v2026.06.15)
Jun 15, 2026	2.62% (0.02617)	83.39th	v5 (v2026.06.15)
Mar 17, 2025	0.01% (0.00005)	0.21th	v4 (v2025.03.14)
Dec 12, 2024	0.30% (0.00303)	70.51th	v3 (v2023.03.01)
Jan 21, 2024	0.19% (0.00193)	57.14th	v3 (v2023.03.01)
Nov 8, 2023	0.16% (0.00163)	52.82th	v3 (v2023.03.01)
Oct 14, 2023	0.19% (0.00193)	56.76th	v3 (v2023.03.01)
Sep 3, 2023	0.18% (0.00184)	54.95th	v3 (v2023.03.01)
Jun 28, 2023	0.15% (0.00154)	50.64th	v3 (v2023.03.01)
Apr 25, 2023	0.14% (0.00135)	47.42th	v3 (v2023.03.01)
Mar 30, 2023	0.11% (0.00114)	43.41th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00071)	28.99th	v3 (v2023.03.01)
Mar 6, 2023	1.63% (0.01626)	75.89th	v2 (v2022.01.01)
Sep 14, 2022	1.63% (0.01626)	74.95th	v2 (v2022.01.01)
Sep 10, 2022	0.95% (0.00954)	34.61th	v2 (v2022.01.01)
Apr 9, 2022	0.95% (0.00954)	32.59th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Mar 24, 2022	0.89% (0.00885)	11.49th	v2 (v2022.01.01)

Weaknesses (2)

CWE-404

Improper Resource Shutdown or Release

CWE-772

References (10)

https://access.redhat.com/security/cve/CVE-2022-0396
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064513
Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
PatchThird Party Advisory
https://kb.isc.org/docs/cve-2022-0396
https://kb.isc.org/v1/docs/cve-2022-0396
MitigationVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
vendor-advisoryMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0396
https://security.gentoo.org/glsa/202210-25
vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20220408-0001/
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0396

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-0396		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064513		Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf		PatchThird Party Advisory
https://kb.isc.org/docs/cve-2022-0396
https://kb.isc.org/v1/docs/cve-2022-0396		MitigationVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/		vendor-advisoryMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0396
https://security.gentoo.org/glsa/202210-25		vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20220408-0001/		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0396