CVE-2022-38178
Estado: ModificadaAlta (7.5)—
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.98%
- Percentil entre todas las CVEs puntuadas: 87
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (4)
CWE
- CWE-401
- CWE-401
Referencias
- http://www.openwall.com/lists/oss-security/2022/09/21/3
- https://kb.isc.org/docs/cve-2022-38178
- https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
- https://security.gentoo.org/glsa/202210-25
- https://security.netapp.com/advisory/ntap-20221228-0009/
- https://www.debian.org/security/2022/dsa-5235
- http://www.openwall.com/lists/oss-security/2022/09/21/3
- https://kb.isc.org/docs/cve-2022-38178
- https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/
- https://security.gentoo.org/glsa/202210-25
- https://security.netapp.com/advisory/ntap-20221228-0009/
- https://www.debian.org/security/2022/dsa-5235
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-38178",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-38178",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-05-28T15:22:52.026415Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-officer@isc.org",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-officer@isc.org",
"affectedData": [
{
"vendor": "ISC",
"product": "BIND9",
"versions": [
{
"status": "affected",
"version": "Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13"
},
{
"status": "affected",
"version": "Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8"
},
{
"status": "affected",
"version": "Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33"
},
{
"status": "affected",
"version": "Open Source Branch 9.18 9.18.0 through versions before 9.18.7"
},
{
"status": "affected",
"version": "Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1"
},
{
"status": "affected",
"version": "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1"
},
{
"status": "affected",
"version": "Development Branch 9.19 9.19.0 through versions before 9.19.5"
}
]
}
]
}
],
"published": "2022-09-21T11:15:09.733",
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2022/09/21/3",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://kb.isc.org/docs/cve-2022-38178",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
"source": "security-officer@isc.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
"source": "security-officer@isc.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
"source": "security-officer@isc.org"
},
{
"url": "https://security.gentoo.org/glsa/202210-25",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20221228-0009/",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://www.debian.org/security/2022/dsa-5235",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2022/09/21/3",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://kb.isc.org/docs/cve-2022-38178",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/202210-25",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20221228-0009/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2022/dsa-5235",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources."
},
{
"lang": "es",
"value": "Al falsificar el resolver objetivo con respuestas que presentan una firma EdDSA malformada, un atacante puede desencadenar una pequeña pérdida de memoria. Es posible erosionar gradualmente la memoria disponible hasta el punto de que named sea bloqueado por falta de recursos"
}
],
"lastModified": "2026-09-01T19:44:42.623",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "444F158A-CA67-4E10-9F4B-DC47B9855E95",
"versionEndIncluding": "9.9.13",
"versionStartIncluding": "9.9.12"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B60E5A42-D9B1-47FF-95AB-E19E54AC90C2",
"versionEndIncluding": "9.10.8",
"versionStartIncluding": "9.10.7"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D33CEC6-E786-49B7-8DDA-13250DB1C9C9",
"versionEndIncluding": "9.16.32",
"versionStartIncluding": "9.11.3"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2FE13E1-0646-46FC-875B-CB4C34E20101"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.3:s4:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39995ADF-74CC-4035-ADB2-010F676FCEC7"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.5:s3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62BDFC28-A025-4512-B3D4-AFB4458A87A5"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AA16E51-819C-4A1B-B66E-1C60C1782C0D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91533F9F-C0E5-4E84-8A4C-F744F956BF97"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46E6A4BD-D69B-4A70-821D-5612DD1315EF"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AF9D390-0D5B-4963-A2D3-BF1E7CD95E9D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB2B92F1-6BA8-41CA-9000-E0633462CC28"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02CA4635-7DFC-408E-A837-856E0F96CA1B"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CABCB08-B838-45F7-AA87-77C6B8767DD0"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.14-s1:*:*:*:preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB597385-BCFD-4CDB-9328-B4F76D586E4D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.19-s1:*:*:*:preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42C76CEF-FD0B-40A4-B246-A71F3EC72B29"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.21:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CC1F26C-4757-4C87-BD8B-2FA456A88C6F"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.27:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "582A4948-B64F-45D4-807A-846A85BB6B42"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.29:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F22E7F6A-0714-480D-ACDF-5027FD6697B2"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.35:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "255AEB06-F071-4433-93E5-9436086C1A6D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.37:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF14D712-5FCF-492F-BE3E-745109E9D6E5"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.16.8:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "288EAD80-574B-4839-9C2C-81D6D088A733"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.16.11:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3595F024-F910-4356-8B5B-D478960FF574"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.16.13:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94661BA2-27F8-4FFE-B844-9404F735579D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.16.21:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "751E37C2-8BFD-4306-95C1-8C01CE495FA4"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.16.32:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC432820-F1A2-4132-A673-2620119553C5"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
"vulnerable": true,
"matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-officer@isc.org"
}