BIND: CVE-2019-6477: TCP-pipelined queries can bypass tcp-clients limit

[icecream-guy]

CVE:                 CVE-2019-6477
Document version:    1.1
Posting date:        20 November 2019
Program impacted:    BIND

Versions affected:   BIND 9.11.6-P1 -> 9.11.12, 9.12.4-P1 -> 9.12.4-P2,
                     9.14.1 -> 9.14.7, and versions 9.11.5-S6 ->
                     9.11.12-S1 of BIND 9 Supported Preview Edition.
                     Versions 9.15.0 -> 9.15.5 of the BIND 9.15
                     development branch are also affected. Versions
                     prior to BIND 9.11.0 have not been evaluated for
                     vulnerability to CVE-2019-6477.

Severity:            Medium
Exploitable:         Remotely

Description:

    By design, BIND is intended to limit the number of TCP clients that
    can be connected at any given time.  The update to this
    functionality introduced by CVE-2018-5743 changed how BIND
    calculates the number of concurrent TCP clients from counting the
    outstanding TCP queries to counting the TCP client connections.   On
    a server with TCP-pipelining capability, it is possible for one TCP
    client to send a large number of DNS requests over a single
    connection.  Each outstanding query will be handled internally as an
    independent client request, thus bypassing the new TCP clients
    limit.

Impact:

    With pipelining enabled each incoming query on a TCP connection
    requires a similar resource allocation to a query received via UDP
    or via TCP without pipelining enabled.  A client using a
    TCP-pipelined connection to a server could consume more resources
    than the server has been provisioned to handle.  When a TCP
    connection with a large number of pipelined queries is closed, the
    load on the server releasing these multiple resources can cause it
    to become unresponsive, even for queries that can be answered
    authoritatively or from cache.  (This is most likely to be perceived
    as an intermittent server problem).

CVSS Score:  6.5
CVSS Vector: CVSS:3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C