ISC BIND: a single TKEY query trips a REQUIRE assertion and exits named

Impact

One malformed TKEY query makes named fail a REQUIRE assertion and exit, with no authentication and no prior relationship to the server. There is no partial degradation - the resolver is simply gone, and it affects recursive and authoritative servers alike regardless of ACLs, because TKEY processing happens before access control. In a datacenter that runs its own resolvers, losing them stalls everything that resolves a name: scheduler-to-node traffic, registry pulls, storage mounts and license checkouts, so a trivial remote packet becomes a cluster-wide outage. This is in CISA's KEV catalogue - it has been exploited in the wild. Affects BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3.

Who can reach it

Any unauthenticated host that can send a UDP or TCP DNS query to the server - internal clients for a private resolver, the whole internet for an exposed authoritative server. No credentials, single packet.

What to do

Upgrade named to 9.9.7-P2 / 9.10.2-P3 or any later supported release, or apply the distribution backport (Fedora, openSUSE and Juniper advisories are in the record), then restart named - a daemon restart per server, no reboot. There is no configuration workaround: the crash happens before ACLs are evaluated, so restricting queries does not protect a reachable server. If any BIND instance in the fleet is still on these versions, treat it as urgent given the KEV listing.

References

Related entries

• Ceph CephX authentication protocol: An attacker who sniffs the storage network can replay a CephX authenticationCVE-2018-1128 · Ceph CephX authentication protocolHigh
• Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm): The IntelliSlot cardCVE-2018-12922 · Emerson/Vertiv Liebert IntelliSlot Web Card (config/configUser.htm, config/configTelnet.htm)High
• ntpd (protocol engine, zero-origin timestamp): Continually sending packets with a zero-origin timestamp lets a remoteCVE-2018-7185 · ntpd (protocol engine, zero-origin timestamp)High
• Ceph RADOS Gateway (RGW, Beast frontend): An unauthenticated client can crash radosgw by sending valid headers followedCVE-2019-10222 · Ceph RADOS Gateway (RGW, Beast frontend)High
• Slurm (srun --uid): Srun --uid drops privileges in the wrong order, so a step launched through it can end up runningCVE-2019-19728 · Slurm (srun --uid)High
• Lustre ptlrpc / mdt modules (client-driven server panic family): The head of a family of ten Lustre defectsCVE-2019-20423 · Lustre ptlrpc / mdt modules (client-driven server panic family)High