A specially crafted DNS response appears to be sufficient to trigger a critical buffer overflow vulnerability in Linux.
The vulnerability identified as CVE-2017-9445 can allow the execution of malicious code by remote intruders on the affected systems. The flaw lies in SystemD, the init and service management system that is preinstalled on several popular Linux distributions.
The developer of Canonical, Chris Coulson, who discovered the security flaw states:
“A remote attacker can trigger the buffer overflow vulnerability to execute malicious code, only with a malicious DNS response”.
The expert detected the vulnerability in the function ‘dns_packet_new’ of ‘systemd-resolved’, which handles DNS responses & provides analysis of the network name to local applications.
A specially crafted DNS response can cause 'systemd-resolved' to crash. This can happen whenever the system does a hostname lookup on an attacker-controlled DNS service. An attacker can trigger the flaw by sending a malicious DNS Response. This will cause a buffer overflow, leading to remote code execution.
How does this happen? According to Coulson, the affected versions of systemd allow an attacker to allocate a small buffer for processing DNS packets by assigning specific sizes to dns_packet_new.
“A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that is too small, and then write arbitrary data to the end of it,” the expert says.
This “out-of-bound” write vulnerability allows an attacker to crash the systemd of a system or write data to memory, allowing code execution on the target machine. All that is needed is a malicious DNS packet.
The bug affects version 223 of Systemd and later versions, including version 233 which was released in March.
Which distributions are affected?
The vulnerability affects Ubuntu 17.04 and 16.10. Debian Stretch (or Debian 9), Buster (Debian 10), and Sid (Debian Unstable), as well as other Linux distributions that use Systemd, are also vulnerable.
Linux users and system administrators should update their installations as soon as possible.
