CVE-2017-15908
systemd Network Name Resolution Manager NSEC Resource Record Pseudo-Types Denial of Service Vulnerability
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.
En systemd 223 hasta 235, un servidor DNS remoto puede responder con un registro de recurso DNS NSEC manipulado de forma personalizada para desencadenar un bucle infinito en la función dns_packet_read_type_window() del servicio "systemd-resolved" y provocar una denegación de servicio en el servicio afectado.
This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of systemd Network Name Resolution Manager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of NSEC resource records in systemd-resolved. The issue results from the lack of proper handling of the pseudo-types in the NSEC bitmap which causes an infinite loop. An attacker can leverage this vulnerability to trigger a denial of service condition for the system users.
*Credits:
Nelson William Gamazo Sanchez - Trend Micro
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-10-25 CVE Reserved
- 2017-10-26 CVE Published
- 2023-06-15 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/101600 | Third Party Advisory | |
| http://www.securitytracker.com/id/1039662 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1725351 | 2022-02-20 | |
| https://github.com/systemd/systemd/pull/7184 | 2022-02-20 | |
| https://usn.ubuntu.com/3558-1 | 2022-02-20 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 223 Search vendor "Systemd Project" for product "Systemd" and version "223" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 224 Search vendor "Systemd Project" for product "Systemd" and version "224" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 225 Search vendor "Systemd Project" for product "Systemd" and version "225" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 226 Search vendor "Systemd Project" for product "Systemd" and version "226" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 227 Search vendor "Systemd Project" for product "Systemd" and version "227" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 228 Search vendor "Systemd Project" for product "Systemd" and version "228" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 229 Search vendor "Systemd Project" for product "Systemd" and version "229" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 230 Search vendor "Systemd Project" for product "Systemd" and version "230" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 231 Search vendor "Systemd Project" for product "Systemd" and version "231" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 232 Search vendor "Systemd Project" for product "Systemd" and version "232" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 233 Search vendor "Systemd Project" for product "Systemd" and version "233" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 234 Search vendor "Systemd Project" for product "Systemd" and version "234" | - |
Affected
| ||||||
| Systemd Project Search vendor "Systemd Project" | Systemd Search vendor "Systemd Project" for product "Systemd" | 235 Search vendor "Systemd Project" for product "Systemd" and version "235" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||