A serious vulnerability has been identified in **Systemd**, a critical init system and service manager widely used in Linux operating systems. This flaw enables remote attackers to exploit a buffer overflow through a crafted DNS response, potentially allowing them to execute malicious code on affected machines.
Labeled as CVE-2017-9445, the vulnerability resides within the dns_packet_new function of systemd-resolved, which is responsible for DNS response handling and provides network name resolution for local applications. An advisory issued recently highlights that an attacker could trigger a denial-of-service condition in the systemd-resolved service, leading to buffer overflow and consequent remote code execution when a system queries an attacker-controlled DNS service.
An attacker can exploit this vulnerability by sending a large, specially crafted DNS response, which results in overwriting the memory on the targeted system. This capability would allow malicious actors to run malware or other harmful programs on the affected system, essentially providing them with remote control.
Chris Coulson, a developer at Canonical, explained, “Certain sizes passed to dns_packet_new in systemd-resolved can result in allocating an excessively small buffer.” He further noted the exploit’s nature—malicious DNS servers could send deceptive TCP payloads to trick systemd-resolved into mismanaging buffer allocations, thus enabling the write of arbitrary data beyond the end of the allocated space.
This vulnerability affects versions of Systemd from 223, released in June 2015, up to and including version 233, which launched in March. It is crucial to note that the systemd-resolved service must be actively running on a user’s system for the vulnerability to be applicable.
Affected distributions include Ubuntu versions 17.04 and 16.10, as well as Debian editions Stretch (Debian 9), Buster (Debian 10), and Sid (Unstable). Various Linux distributions utilizing Systemd are also at risk. System administrators are urged to apply the emergency patches that have been released to remedy this vulnerability.
In the context of the MITRE ATT&CK framework, this incident potentially falls under tactics such as initial access and privilege escalation, indicative of how attackers could manipulate the environment for their advantage. This serves as a critical reminder to business owners and IT professionals to remain vigilant in updating systems and applying security patches expeditiously to mitigate exposure to known vulnerabilities.
As the landscape of cybersecurity threats continues to evolve, active monitoring and prompt action are essential in safeguarding systems against such exploits.