CVE-2017-10980: High severity freeradius vulnerability
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decodetlv()" and a denial of service.
Other sources
It was discovered that decodetlv() function leaked memory in certain circumstances.
The security impact is denial of service by any network device capable of sending DHCP packets to FreeRADIUS, which sends option 82 with multiple sub-options.
Affected versions: 2.0.0 through 2.2.9, inclusive.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10980?
CVE-2017-10980 has a high severity, leading to potential denial of service due to a memory leak.
How do I fix CVE-2017-10980?
To fix CVE-2017-10980, upgrade FreeRADIUS to version 2.2.10 or later.
What are the affected versions of FreeRADIUS for CVE-2017-10980?
Affected versions of FreeRADIUS include all versions before 2.2.10 and specifically include 2.0.0 through 2.2.9.
What is the potential impact of CVE-2017-10980 on my network?
CVE-2017-10980 may allow an attacker to cause a denial of service by exhausting memory resources.
How was CVE-2017-10980 discovered?
CVE-2017-10980 was discovered due to a memory leak in the decode_tlv() function when processing certain DHCP packets.