CVE-2025-40775

HIGH

DNS message with invalid TSIG causes an assertion failure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-40775 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 21, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

BIND 9

Browse ISC / BIND 9

Default status: unaffected

CVE List9.20.0 to ≤ 9.20.8affected
9.21.0 to ≤ 9.21.7affected

Proofs of concept

1

Repository PoCs

GitHubAlexSvobo/nhi-zero-trust-bypassRepository PoCby AlexSvobo5Not analyzed29 files

325.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

AlexSvobo/nhi-zero-trust-bypassCreated Vuln labCVE-2025-40775Compose · builds

1 Compose manifest · 3 Dockerfiles · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a vulnerable BIND 9.20.8 DNS server, a mock secrets manager, and a mock API service to demonstrate a DNS DoS attack chain leading to NHI secret exposure and zero-trust bypass.

docker-compose.yml:1-57README.md:1-123

Lab assessment

Vulnerability lab

The README explicitly states the objective is to demonstrate exploitation of CVE-2025-40775 to crash DNS, disrupt NHI rotation, and bypass zero-trust. The Dockerfile builds the vulnerable BIND version from source, and the Compose file orchestrates the target and supporting mock services.

README.md:1-3README.md:33-35docker/bind-vulnerable-build/Dockerfile:1-6
Lab shapeCompose · builds
Services3
Compose manifests1
Dockerfiles3
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

bind-dns

vulnerable DNS server target

Builds BIND 9.20.8 from source, runs named with a minimal configuration, and exposes DNS on host port 53530. The Dockerfile downloads the official tarball, compiles with specific options, and copies in named.conf and named.ca.

docker-compose.yml:2-22docker/bind-vulnerable-build/Dockerfile:1-111

secrets-manager

mock secrets managerNHI rotation simulator

A Flask app that simulates secret rotation and fallback. It checks DNS resolution via the MOCK_DNS_SERVER environment variable and returns a static fallback NHI when DNS is down and rotation fails.

docker-compose.yml:24-35secrets-manager-mock/app.py:1-55

api-service

protected API endpointzero-trust bypass target

A Flask app that accepts a static API key or a JWT for authentication. It grants access to sensitive data when the correct static key is provided, simulating a zero-trust bypass.

docker-compose.yml:37-45api-service-mock/app.py:1-44
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-40775

Supported by supplied evidence

The README describes the vulnerability as a DoS in BIND 9.20.0–9.20.8 triggered by a malformed TSIG algorithm field. The Dockerfile builds BIND 9.20.8 from the official tarball, and the exploit script dns_exploit.py crafts a packet with an invalid TSIG algorithm name targeting this version.

README.md:99-107docker/bind-vulnerable-build/Dockerfile:7-8dns_exploit.py:1-82
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:79-81
  • The BIND container must be running and reachable on host port 53530 for the DNS exploit.dns_exploit.py:5-7
  • The exploit script dns_exploit.py requires root/administrator privileges to send raw packets.dns_exploit.py:72-76

Evidence-described exercise path

  1. Build and start the Docker Compose environment.README.md:79-81
  2. Run dns_exploit.py to send a malformed TSIG DNS packet to the BIND server, causing a crash.README.md:83-85dns_exploit.py:1-82
  3. Run client_nhi_rotation.py to simulate NHI rotation failure due to DNS outage, leading to fallback on a static credential.README.md:87-89client_nhi_rotation.py:1-58
  4. Run bypass_demo.py to use the static credential to access the protected API, demonstrating zero-trust bypass.README.md:91-93bypass_demo.py:1-12
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own containers. The DNS exploit is directed at the vulnerable BIND service within the Docker network. The mock services simulate secret rotation and API access. No evidence of host escape, external connections, persistence, credential theft outside the lab, or destructive behavior beyond the intended DoS demonstration.

dns_exploit.py:5-7bypass_demo.py:3-4client_nhi_rotation.py:5
Review boundaries

What the analysis did not establish

  • The packet does not include the actual named.conf or named.ca files used at build time; only the copies in docker/bind-vulnerable-build/config/ are present.
  • The main.py script references hardcoded IP addresses (172.18.0.x) that may not match the actual Docker network, and its tcpdump command requires sudo and may not function in all environments.
  • The exploit script dns_exploit.py uses a placeholder algorithm name and may not reliably trigger the CVE without further tuning.
  • No runtime logs or crash confirmation are included in the evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4