Bug 1522918 (CVE-2017-3144)

Summary:	CVE-2017-3144 dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	carnil, jpopelka, pemensik, pzhukov, security-response-team, slawomir, thozza
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port could use this flaw to exhaust file descriptors in the DHCP daemon, leading to a denial of service in the OMAPI functionality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:32:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1519363, 1523475, 1523547
Bug Blocks:	1522919

Description Adam Mariš 2017-12-06 17:52:56 UTC

It was found that omapi code doesn't free socket descriptor if empty message was sent by client, which allows malicious client to use up all available descriptors causing Denial of Service.

Upstream patch:

https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commit;h=1a6b62fe17a

Comment 5 Dhiru Kholia 2017-12-08 09:42:46 UTC

Created dhcp tracking bugs for this issue:

Affects: fedora-all [bug 1523547]

Comment 7 Dhiru Kholia 2018-01-17 04:57:16 UTC

External References:

https://kb.isc.org/article/AA-01541

Comment 9 errata-xmlrpc 2018-01-25 11:30:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0158 https://access.redhat.com/errata/RHSA-2018:0158