CVE-2017-9217 Null dereference in n/a

High 7.5 Published 24 May 2017 Updated 13 Dec 2024

Remote attackers can crash the systemd-resolved daemon by sending a crafted DNS response with an empty question section.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-9217?

CVE-2017-9217 is a high-severity vulnerability in Systemd Project Systemd, published on 24 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.

Weakness: CWE-476

Which versions are affected by CVE-2017-9217?

It affects 1 product.

Linux distribution packages (5)

`systemd` SUSE:Linux Enterprise Desktop 12 SP2	All versions	`228-149.3`
`systemd` SUSE:Linux Enterprise Server 12 SP2	All versions	`228-149.3`
`systemd` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	All versions	`228-149.3`
`systemd` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`228-149.3`
`systemd` SUSE:Linux Enterprise Software Development Kit 12 SP2	All versions	`228-149.3`

Products include Systemd Project Systemd.

How do I fix CVE-2017-9217?

Apply the vendor's patch.

Is CVE-2017-9217 being exploited?

There is no known exploitation of CVE-2017-9217 in the wild and no public exploit code.

All Systemd Project Systemd vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-9217, GHSA-pv82-vf69-rqqm, SUSE-SU-2017:1773-1, UBUNTU-CVE-2017-9217.