CVE-2020-7217
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows...
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
- Record
CVE-2020-7217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-401
- Updated
- 2026-11-02
CVE List No score
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
- Record
CVE-2020-7217- Updated
- 2026-11-02
EUVDEUVD-2020-28349 No score
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
- Record
EUVD-2020-28349- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j299-xp2p-5fm9 No score
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows...
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
- Record
GHSA-j299-xp2p-5fm9- Weakness
- CWE-401, CWE-772
- Updated
- 2026-11-02
OSV
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with a different client-id.
- Record
CVE-2020-7217- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0207-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0207-1- Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2024:11511-1 No score
wicked-0.6.66-1.2 on GA media
These are all security issues fixed in the wicked-0.6.66-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11511-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0347-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0347-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0351-1 No score
Security update for wicked
This update for wicked fixes the following issues:
Security issues fixed:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
Non-security issue fixed:
- dhcp4: Fixed an intermittent hang during network setup by cleaning up the defer timer pointer (bsc#1142214).
- Record
SUSE-SU-2020:0351-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0358-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0358-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0369-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0369-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0370-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0370-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0410-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0410-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wickedSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 2 CVEs |
before 0.6.60-3.13.1 | 0.6.60-3.13.1 |
wickedSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 4 CVEs |
before 0.6.60-3.5.1 | 0.6.60-3.5.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 4 CVEs |
before 0.6.60-3.5.1 | 0.6.60-3.5.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 4 CVEs |
before 0.6.60-28.26.1 | 0.6.60-28.26.1 |
wickedSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 4 CVEs |
before 0.6.60-28.26.1 | 0.6.60-28.26.1 |
wickedSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 4 CVEs |
before 0.6.60-2.18.1 | 0.6.60-2.18.1 |
wickedSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 4 CVEs |
before 0.6.60-2.18.1 | 0.6.60-2.18.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 0.6.60-2.18.1 | 0.6.60-2.18.1 |
wickedSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 2 CVEs |
before 0.6.60-3.24.1 | 0.6.60-3.24.1 |
wickedSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 0.6.60-3.24.1 | 0.6.60-3.24.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wickedSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 0.6.60-3.24.1 | 0.6.60-3.24.1 |
wickedSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 0.6.60-3.24.1 | 0.6.60-3.24.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 0.6.60-3.24.1 | 0.6.60-3.24.1 |
wickedopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 0.6.60-lp151.2.9.1 | 0.6.60-lp151.2.9.1 |
wickedopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.6.66-1.2 | 0.6.66-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7217 is a high vulnerability (CVSS 7.5) in Opensuse Wicked, published February 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. No source names a fixed version.
References
bugzilla.suse.com/show_bug.cgi?id=1160906
suse.com/security/cve/CVE-2020-7217
github.com/openSUSE/wicked/releases
lists.opensuse.org/opensuse-security-announce/2020-02/msg00011.html
nvd.nist.gov/vuln/detail/CVE-2020-7217
Show 15 moreShow less