named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
Published Jan 25, 2023
7.5
HIGHCVSS 3.1
EPSS 16.11%
Description
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.
If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
Affected products
-
- Version 9.16.12StatusaffectedConstraints<=9.16.36
- Version 9.16.12-S1StatusaffectedConstraints<=9.16.36-S1
- Version 9.18.0StatusaffectedConstraints<=9.18.10
- Version 9.19.0StatusaffectedConstraints<=9.19.8
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
- ≥ 9.16.12 · < 9.16.37
- ≥ 9.18.0 · < 9.18.11
- ≥ 9.19.0 · < 9.19.9
- 9.16.12
- 9.16.13
- 9.16.14
- 9.16.21
- 9.16.32
- 9.16.36
No data.
Red Hat Enterprise Linux 8
bind9.16-32:9.16.23-0.14.el8
Fixed · RHSA-2023:2792
Red Hat Enterprise Linux 9
bind-32:9.16.23-11.el9
Fixed · RHSA-2023:2261
Red Hat Enterprise Linux 6
bind
Not affected
Red Hat Enterprise Linux 7
bind
Not affected
Red Hat Enterprise Linux 8
bind
Not affected
Red Hat Enterprise Linux 9
dhcp
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | bind9.16-32:9.16.23-0.14.el8 | Fixed | RHSA-2023:2792 |
| Red Hat Enterprise Linux 9 | bind-32:9.16.23-11.el9 | Fixed | RHSA-2023:2261 |
| Red Hat Enterprise Linux 6 | bind | Not affected | n/a |
| Red Hat Enterprise Linux 7 | bind | Not affected | n/a |
| Red Hat Enterprise Linux 8 | bind | Not affected | n/a |
| Red Hat Enterprise Linux 9 | dhcp | Not affected | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to the patched release most closely related to your current version of BIND 9: 9.16.37, 9.18.11, 9.19.9, or 9.16.37-S1.
Red Hat statement
The flaw exists in the implementation of the stale-answer-client-timeout option, which was first effectively introduced in BIND 9.16.12
Red Hat mitigation
Disabling stale-answer-client-timeout entirely or setting the timeout value to zero prevents the problem. It is not possible to disable the limit on recursive-clients, though it could be set to a very high value in order to reduce the likelihood of encountering this scenario. However, this is not recommended as the limit on recursive clients is important for preventing exhaustion of server resources.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Mar 31, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2023–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (16 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 16.11% (0.16115) | 96.83th | v5 (v2026.06.15) |
| Jun 28, 2026 | 15.99% (0.15989) | 96.50th | v5 (v2026.06.15) |
| Jun 15, 2026 | 17.40% (0.17400) | 96.72th | v5 (v2026.06.15) |
| Apr 27, 2026 | 2.83% (0.02830) | 86.22th | v4 (v2025.03.14) |
| Feb 18, 2026 | 0.52% (0.00524) | 66.41th | v4 (v2025.03.14) |
| Nov 21, 2025 | 1.70% (0.01701) | 81.72th | v4 (v2025.03.14) |
| Mar 30, 2025 | 0.59% (0.00590) | 66.65th | v4 (v2025.03.14) |
| Mar 29, 2025 | 2.85% (0.02847) | 77.02th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.59% (0.00590) | 67.31th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.09% (0.00093) | 41.33th | v3 (v2023.03.01) |
| Jul 7, 2024 | 0.09% (0.00090) | 38.81th | v3 (v2023.03.01) |
| May 3, 2024 | 0.08% (0.00081) | 34.35th | v3 (v2023.03.01) |
| Feb 1, 2024 | 0.08% (0.00078) | 32.16th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.06% (0.00063) | 25.31th | v3 (v2023.03.01) |
| Mar 6, 2023 | 0.89% (0.00885) | 27.89th | v2 (v2022.01.01) |
| Jan 26, 2023 | 0.89% (0.00885) | 27.43th | v2 (v2022.01.01) |
References (5)
- https://access.redhat.com/security/cve/CVE-2022-3924 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2164039 Issue Tracking
- https://kb.isc.org/docs/cve-2022-3924 vendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-3924
- https://www.cve.org/CVERecord?id=CVE-2022-3924
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-3924 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2164039 | Issue Tracking | |
| https://kb.isc.org/docs/cve-2022-3924 | vendor-advisoryVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-3924 | ||
| https://www.cve.org/CVERecord?id=CVE-2022-3924 |
Change history (0)
No recorded changes yet.