Vulnerability record · CVE-2020-8617 · published 19 May 2020
CVE-2020-8617: BIND TSIG key handling causes assertion failure and daemon exit
Isc · Bind
A crafted DNS message can drive a BIND server into an inconsistent state when the attacker knows or guesses the name of a TSIG key the server uses. Because BIND configures a local session key by default even when TSIG is not otherwise configured, nearly all BIND servers are exposed. Releases from March 2018 onward detect the inconsistency and deliberately exit, so the practical result is a denial of service.
Description
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated denial of service against a widely deployed DNS server with very high EPSS, though the need to know or guess the TSIG key name and the availability-only impact keep it below critical.
What it is
A crafted DNS message can drive a BIND server into an inconsistent state when the attacker knows or guesses the name of a TSIG key the server uses. Because BIND configures a local session key by default even when TSIG is not otherwise configured, nearly all BIND servers are exposed. Releases from March 2018 onward detect the inconsistency and deliberately exit, so the practical result is a denial of service.
Impact
An attacker can terminate the named process, disrupting DNS resolution for clients served by that instance. There is no confidentiality or integrity impact; the CVSS vector shows availability-only (A:H).
Attack surface
Reachable remotely over the network via DNS messages (AV:N) with no authentication or user interaction required (PR:N, UI:N). The attacker must know or guess the TSIG key name, which raises attack complexity (AC:H).
Exploitation
Not listed in CISA KEV and no ransomware association is documented. EPSS is very high (0.934 probability, 99.8th percentile), and references include a Packet Storm denial-of-service entry plus vendor and distro advisories, indicating public technical detail exists.
What to do
- Patch BIND to a fixed release using the ISC advisory (kb.isc.org/docs/cve-2020-8617) or your distribution's update (Debian DSA-4689, Ubuntu USN-4365-1/2, Fedora, openSUSE).
- If patching cannot be done immediately, restrict DNS query access to trusted networks and disable or remove unused TSIG keys, including the default local session key where feasible.
- Monitor and rate-limit inbound DNS traffic to reduce the chance of a successful key-name guess and repeated crash attempts.
- Verify the named service restarts cleanly and check for unexpected exits after applying updates.
Detection
- Alert on named process termination or restart events, especially repeated crashes correlated with inbound DNS traffic.
- Search BIND logs for assertion failures in tsig.c or messages about an inconsistent state.
- Baseline normal DNS query volume and flag spikes or unusual TSIG-related queries from external sources.
- Track service availability of DNS resolvers and alert on gaps in resolution service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-8617 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-8617), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
