The vulnerability CVE-2024-11187 affects the bind package as shipped by Red Hat OpenShift AI 2.18.0 and related products. A crafted DNS zone can cause the server to generate a large number of records in the 'Additional' section of DNS responses. Attackers can exploit this by sending many such queries, causing uncontrolled CPU resource consumption on authoritative DNS servers or resolvers. This resource exhaustion results in denial of service, making the server unable to process new requests. The bind package does not enable the 'minimal-responses yes;' option by default, which would limit the size of DNS responses and mitigate the issue. Red Hat advises users to enable this option in the /etc/named.conf configuration file as a mitigation. There is no mention of an official patch or fix in the advisory, and no known exploits are reported in the wild. The vulnerability is classified under multiple CWEs related to resource exhaustion and access control.

The vulnerability can cause denial of service by exhausting CPU resources on DNS authoritative servers or resolvers when processing crafted DNS queries with many additional records. This prevents the server from attending to legitimate requests, impacting availability. There is no impact on confidentiality or integrity reported. No known active exploitation has been observed.

Red Hat does not currently provide an official patch or fix for this vulnerability. Users are advised to mitigate the issue by setting the option 'minimal-responses yes;' in the /etc/named.conf configuration file of the bind package. This reduces the size of DNS responses and limits CPU resource consumption. Follow Red Hat's documentation for upgrading and applying errata updates to Red Hat OpenShift AI 2.18.0. Monitor Red Hat advisories for any future official fixes.