Bug 1507515 (CVE-2017-15908)

Summary:	CVE-2017-15908 systemd: Infinite loop in the dns_packet_read_type_window() function
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lnykryn, msekleta, ssahani, s, systemd-maint-list, systemd-maint, yozone, zbyszek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-10-30 13:28:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Andrej Nemec 2017-10-30 13:26:40 UTC

In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.

References:

https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1725351

Upstream pull request:

https://github.com/systemd/systemd/pull/7184

Upstream patch:

https://github.com/systemd/systemd/commit/8aeadf3052a2130b88d5bccf5439890e1034f28d

Comment 1 Andrej Nemec 2017-10-30 13:28:57 UTC

Statement:

This issue did not affect the versions of systemd as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.