CVE-2017-9445

Description

In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.

Weakness classification

• CWE-787: Out-of-bounds Write

Primary references

• cve@mitre.org — Mailing List, Patch, Third Party Advisory
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link