Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled

Summary

A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: • `nxdomain-redirect <domain>;` is configured, and • the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Timeline

1. Feb 13, 2024, 2:04 PM UTCCVE published
2. Aug 22, 2024, 1:32 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Feb 13, 2025, 5:25 PM UTCRecord last updated

Affected versions

• ISC BIND 9

  From 9.12.0 · through 9.16.45; From 9.18.0 · through 9.18.21; From 9.19.0 · through 9.19.19; From 9.16.8-S1 · through 9.16.45-S1; From 9.18.11-S1 · through 9.18.21-S1

References 7