CVE-2017-3144: Failure to properly clean up closed OMAPI connections can exhaust available sockets
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested.
Other sources
It was found that omapi code doesn't free socket descriptor if empty message was sent by client, which allows malicious client to use up all available descriptors causing Denial of Service.
Upstream patch:
https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commit;h=1a6b62fe17a
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3144?
CVE-2017-3144 is classified as a medium severity vulnerability due to its potential to exhaust socket descriptors.
How do I fix CVE-2017-3144?
To mitigate CVE-2017-3144, upgrade ISC DHCP to version 4.4 or later or apply vendor patches as specified.
What systems are affected by CVE-2017-3144?
CVE-2017-3144 affects ISC DHCP versions 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, and 4.3.0 to 4.3.6.
What causes CVE-2017-3144?
CVE-2017-3144 is caused by the failure to properly clean up closed OMAPI connections, leading to resource exhaustion.
Can older versions of ISC DHCP be impacted by CVE-2017-3144?
Yes, older versions of ISC DHCP may also be vulnerable to CVE-2017-3144, although they are not explicitly listed.