CVE-2017-9445
High · 7.5CVSS
7.5
EPSS
54.8%
Published
Jun 28, 2017
CISA due date
—
The record
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | systemd | 0 | 233-10 |
| Debian:12 | systemd | 0 | 233-10 |
| Debian:13 | systemd | 0 | 233-10 |
| SUSE:Linux Enterprise Desktop 12 SP2 | dracut | 0 | 044.1-109.8.3 |
| SUSE:Linux Enterprise Desktop 12 SP2 | systemd | 0 | 228-150.7.1 |
| SUSE:Linux Enterprise Desktop 12 SP3 | systemd | 0 | 228-150.9.3 |
| SUSE:Linux Enterprise Server 12 SP2 | dracut | 0 | 044.1-109.8.3 |
| SUSE:Linux Enterprise Server 12 SP2 | systemd | 0 | 228-150.7.1 |
| SUSE:Linux Enterprise Server 12 SP3 | systemd | 0 | 228-150.9.3 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | dracut | 0 | 044.1-109.8.3 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | systemd | 0 | 228-150.7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | dracut | 0 | 044.1-109.8.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | systemd | 0 | 228-150.7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | systemd | 0 | 228-150.9.3 |
| SUSE:Linux Enterprise Software Development Kit 12 SP2 | systemd | 0 | 228-150.7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP3 | systemd | 0 | 228-150.9.3 |
| Ubuntu:14.04:LTS | systemd | 0 | 204-5ubuntu20.24 |
| Ubuntu:16.04:LTS | systemd | 0 | 229-4ubuntu19 |
| openSUSE:Tumbleweed | systemd | 0 | 249.4-2.2 |
Related vulnerabilities
- CVE-2023-50868 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… Also affects systemd
- CVE-2019-6454 An issue was discovered in sd-bus in systemd 239. Also affects systemd
- CVE-2017-15908 In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS… Also affects systemd
- CVE-2017-9217 systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon… Also affects systemd
- CVE-2026-40224 In systemd 259 before 260, there is local privilege escalation in systemd-machined… Also affects systemd
- CVE-2026-29111 systemd, a system and service manager, (as PID 1) hits an assert and freezes execution… Also affects systemd
- CVE-2026-4105 A flaw was found in systemd. Also affects systemd
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787