CVE-2017-10986: High severity freeradius vulnerability
An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcpattr2vp()" and a denial of service.
Other sources
When decoding "string" options in an array, dhcpattr2vp() could be convinced to call memchr() with a length argument of -1. This could result in an over-read until the first zero octet was found, or a page fault occured.
The security impact is denial of service by any network device capable of sending DHCP packets to FreeRADIUS, which sends string options to the server in an option array.
Affected versions: 3.0.0 through 3.0.14, inclusive.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10986?
CVE-2017-10986 is classified as a denial of service vulnerability in FreeRADIUS that can lead to service interruptions.
How do I fix CVE-2017-10986?
To fix CVE-2017-10986, upgrade FreeRADIUS to version 3.0.15 or later.
What software is affected by CVE-2017-10986?
CVE-2017-10986 affects FreeRADIUS versions prior to 3.0.15.
What type of vulnerability is CVE-2017-10986?
CVE-2017-10986 is a security vulnerability that allows for an infinite read within the DHCP attribute processing.
Can CVE-2017-10986 be exploited remotely?
Yes, CVE-2017-10986 can be exploited remotely, potentially allowing an attacker to cause a denial of service.