{"id":"CVE-2017-9445","aliases":["DEBIAN-CVE-2017-9445","EUVD-2017-18378","GHSA-42xm-66qf-5jj8","SUSE-SU-2017:1898-1","SUSE-SU-2017:2031-1","UBUNTU-CVE-2017-9445","openSUSE-SU-2024:11420-1"],"status":"published","title":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it...","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.58808,"percentile":0.99113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-06-27T00:00:00Z","modified":"2026-10-24T10:31:01Z","fixes":[{"ecosystem":"Debian:12","package":"systemd","fixed_in":["233-10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd","fixed_in":["233-10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd","fixed_in":["233-10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"dracut","fixed_in":["044.1-109.8.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"systemd","fixed_in":["228-150.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dracut","fixed_in":["044.1-109.8.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"systemd","fixed_in":["228-150.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"systemd","fixed_in":["228-150.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dracut","fixed_in":["044.1-109.8.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"systemd","fixed_in":["228-150.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dracut","fixed_in":["044.1-109.8.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"systemd","fixed_in":["228-150.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"systemd","fixed_in":["229-4ubuntu19"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"233-10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"233-10"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"233-10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044.1-109.8.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044.1-109.8.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044.1-109.8.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044.1-109.8.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"228-150.9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"229-4ubuntu19"}]}],"versions":["225-1ubuntu9","227-2ubuntu1","227-2ubuntu2","228-1ubuntu2","228-2ubuntu1","228-2ubuntu2","228-3ubuntu1","228-4ubuntu1","228-4ubuntu2","228-5ubuntu1","228-5ubuntu2","228-5ubuntu3","228-6ubuntu1","229-1ubuntu2","229-1ubuntu4","229-2ubuntu1","229-3ubuntu1","229-3ubuntu2","229-4ubuntu1","229-4ubuntu4","229-4ubuntu5","229-4ubuntu6","229-4ubuntu7","229-4ubuntu8","229-4ubuntu10","229-4ubuntu11","229-4ubuntu12","229-4ubuntu13","229-4ubuntu16","229-4ubuntu17"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"249.4-2.2"}]}],"bundled":19}],"products":[{"vendor":"systemd_project","product":"systemd"}],"references":[{"url":"https://launchpad.net/bugs/1695546","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://www.securitytracker.com/id/1038806","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/99302","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://openwall.com/lists/oss-security/2017/06/27/8","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9445"},{"url":"https://github.com/advisories/GHSA-42xm-66qf-5jj8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9445","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171898-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032029","tags":["report"]},{"url":"https://bugzilla.suse.com/1033238","tags":["report"]},{"url":"https://bugzilla.suse.com/1037120","tags":["report"]},{"url":"https://bugzilla.suse.com/1040153","tags":["report"]},{"url":"https://bugzilla.suse.com/1040968","tags":["report"]},{"url":"https://bugzilla.suse.com/1043900","tags":["report"]},{"url":"https://bugzilla.suse.com/1045290","tags":["report"]},{"url":"https://bugzilla.suse.com/1046750","tags":["report"]},{"url":"https://bugzilla.suse.com/986216","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9445","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172031-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1004995","tags":["report"]},{"url":"https://bugzilla.suse.com/1029102","tags":["report"]},{"url":"https://bugzilla.suse.com/1029516","tags":["report"]},{"url":"https://bugzilla.suse.com/1036873","tags":["report"]},{"url":"https://bugzilla.suse.com/1038865","tags":["report"]},{"url":"https://bugzilla.suse.com/1040258","tags":["report"]},{"url":"https://bugzilla.suse.com/1040614","tags":["report"]},{"url":"https://bugzilla.suse.com/1040942","tags":["report"]},{"url":"https://bugzilla.suse.com/1043758","tags":["report"]},{"url":"https://bugzilla.suse.com/982303","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9217","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-9445","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3341-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9445","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33910","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9445","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2017-06-28T06:00:00Z","modified":"2024-08-05T17:11:01.693Z","updated_at":"2026-11-02T14:33:13.96587Z"}],"euvd":[{"id":"EUVD-2017-18378","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2017-06-28T06:00:00Z","modified":"2024-08-05T17:11:01Z","updated_at":"2026-11-03T02:23:28.210565Z"}],"ghsa":[{"id":"GHSA-42xm-66qf-5jj8","title":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it...","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2022-05-13T01:04:11Z","modified":"2023-02-01T05:02:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2017-9445","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2017-06-28T06:29:00.19Z","modified":"2026-06-17T01:28:07.27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-9445","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2017-06-28T06:29:00.19Z","modified":"2026-10-24T10:31:01.81650022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9445","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2017-06-28T06:29:00.19Z","modified":"2026-09-01T20:03:51.897197758Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9445","description":"In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.","status":"published","published":"2017-06-27T00:00:00Z","modified":"2026-04-22T11:37:47.449249Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"openSUSE-SU-2024:11420-1","title":"libsystemd0-249.4-2.2 on GA media","description":"These are all security issues fixed in the libsystemd0-249.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:22.858405Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:1898-1","title":"Security update for systemd, dracut","description":"This update for systemd and dracut fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-9445: Possible out-of-bounds write triggered by a specially crafted TCP payload\n  from a DNS server. (bsc#1045290)\n\nNon-security issues fixed in systemd:\n\n- Automounter issue in combination with NFS volumes (bsc#1040968)\n- Missing symbolic link for SAS device in /dev/disk/by-path (bsc#1040153)\n- Add minimal support for boot.d/* scripts in systemd-sysv-convert (bsc#1046750)\n\nNon-security issues fixed in dracut:\n\n- Bail out if module directory does not exist. (bsc#1043900)\n- Suppress bogus error message. (bsc#1032029)\n- Fix module force loading with systemd. (bsc#986216)\n- Ship udev files required by systemd. (bsc#1040153)\n- Ignore module resolution errors (e.g. with kgraft). (bsc#1037120)\n","status":"published","published":"2017-07-19T09:13:10Z","modified":"2025-05-02T04:07:09.556275Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2031-1","title":"Security update for systemd","description":"This update for systemd provides several fixes and enhancements.\n\nSecurity issues fixed:\n\n- CVE-2017-9217: Null pointer dereferencing that could lead to resolved aborting. (bsc#1040614)\n- CVE-2017-9445: Possible out-of-bounds write triggered by a specially crafted TCP payload\n  from a DNS server. (bsc#1045290)\n\nThe update also fixed several non-security bugs:\n\n- core/mount: Use the '-c' flag to not canonicalize paths when calling /bin/umount\n- automount: Handle expire_tokens when the mount unit changes its state (bsc#1040942)\n- automount: Rework propagation between automount and mount units\n- build: Make sure tmpfiles.d/systemd-remote.conf get installed when necessary\n- build: Fix systemd-journal-upload installation\n- basic: Detect XEN Dom0 as no virtualization (bsc#1036873)\n- virt: Make sure some errors are not ignored\n- fstab-generator: Do not skip Before= ordering for noauto mountpoints\n- fstab-gen: Do not convert device timeout into seconds when initializing JobTimeoutSec\n- core/device: Use JobRunningTimeoutSec= for device units (bsc#1004995)\n- fstab-generator: Apply the _netdev option also to device units (bsc#1004995)\n- job: Add JobRunningTimeoutSec for JOB_RUNNING state (bsc#1004995)\n- job: Ensure JobRunningTimeoutSec= survives serialization (bsc#1004995)\n- rules: Export NVMe WWID udev attribute (bsc#1038865)\n- rules: Introduce disk/by-id (model_serial) symbolic links for NVMe drives\n- rules: Add rules for NVMe devices\n- sysusers: Make group shadow support configurable (bsc#1029516)\n- core: When deserializing a unit, fully restore its cgroup state (bsc#1029102)\n- core: Introduce cg_mask_from_string()/cg_mask_to_string()\n- core:execute: Fix handling failures of calling fork() in exec_spawn() (bsc#1040258)\n- Fix systemd-sysv-convert when a package starts shipping service units (bsc#982303)\n  The database might be missing when upgrading a package which was\n  shipping no sysv init scripts nor unit files (at the time --save was\n  called) but the new version start shipping unit files.\n- Disable group shadow support (bsc#1029516)\n- Only check signature job error if signature job exists (bsc#1043758)\n- Automounter issue in combination with NFS volumes (bsc#1040968)\n- Missing symbolic link for SAS device in /dev/disk/by-path (bsc#1040153)\n- Add minimal support for boot.d/* scripts in systemd-sysv-convert (bsc#1046750)\n","status":"published","published":"2017-08-03T08:43:31Z","modified":"2026-02-04T03:54:21.672724Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}