Socket Descriptor Exhaustion Vulnerability in ISC DHCP
Summary
CVE-2017-3144: A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects isc-dhcp across 36 version ranges.
< 2a00efe8700df8bfd11881fdabeb18f33e8d9fe6
< 2a4ff20abc29fe2647de68e6a6eea8e49e6ce941
< 2d5ca865b7268d2f60a485c9a50f96b7890dd51f
< 3a1078b6d1292305c9e784cdce97d9ae6934cc01
< 4.3.5-3.1
< 4f5c8255511e3600288eddfa6a4e594fde107458
>= 5de62c8b34a94e66269b39c663cd222047216306, <= c1bd79a15e9b689e8a18538aaedec0ab8bd04b17
< 5e1ef01178527149e5673002dbdc3be18046c77e
< 9f35323a8abe2ed4bc567b2b2613fc3ef9254e8f
< 9ff9a4e8131e7b5f144050b538ff866f89c98ffc
< 034fe1d0edc30d6912718cb547f12b8c215b4cf2
< 54ec15cba2c5157bedf45cae9d062814e75e928e
>= 079f747eb20d40e80c65e8a984d6c50860560b3c, <= 8541c4fcbc6364800775234bacfe646ef16bfd38
< 192a3579019c9f0c4095371d783c22efd74ba9bf
< 240d9b62e137cad28a08893326ab66d4cd7bbb89
< 847b32280a9d52c3f30db4dc2ed620abbeda708c
< 3709b7fc844ab8384ba40a1be3cf7916168423e1
< 8423b4587ea3eef2a55b9ab693c828d46e238f0a
< 331193dd54344dc74ca1987797d99bb57ba277fe
< 703432ad969076f6a4eb9566db5634cceeb12572
< a05db3d943208ab168a9aba9117706bb58baea7c
< a43c1faf96b8647d2a87fc0b5ef044c79cc1c852
< a185640cf1d8fd71b5c62ac4b4c9572996248b63
< b8ee38f1a50299e35c37a0eeadce30051dda7696
< b39dd193dc3d189d3669866d73a87172545e2a4b
< b54c35c0c840395bc1e62dd8484eab610837d01a
< b5672a6ffffad5c2455e5d50e4c2e5ef1e99f925
< c4a3c3ee213715ff5a3f6255001148e333029741
< c57dbea3ca687b929a7bf8171c21ad9dc66461bf
< d6f132e4523d4a317f18a395ade0c4927867bc67
< db3e58c1515b19d6fb4f1aa46445cbbcb4261e65
< dda169525b6109935c76d2a7f0c479ff4fda0e82
< f0bd8bdff79188c900a31e763377eb1d25e80eb0
< f9eeba56095a43b985292025a2b4a46085cff2ea
< f10f02aa92b38606897523e19ad090fc0464a955
< f615b2d9be5ebe1762de0677a1e5c151519217aa
Fixed in 4.3.5-3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ISC DHCP is a widely used open-source implementation of the Dynamic Host Configuration Protocol (DHCP), which is responsible for dynamically assigning IP addresses and other network configuration parameters to devices on a network. The software is crucial for managing network resources efficiently. However, certain versions of ISC DHCP are vulnerable to a specific issue that can lead to the exhaustion of socket descriptors, impacting the server's ability to function properly.
Vulnerability Detail
The vulnerability, identified as CVE-2017-3144, arises from the failure to properly clean up closed OMAPI connections. This oversight can lead to the exhaustion of the pool of socket descriptors available to the DHCP server. As a result, the server may become unable to accept new connections, potentially leading to network outages or disruptions. The affected versions include ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, and 4.3.0 to 4.3.6. Older versions may also be affected but are beyond their end-of-life (EOL). The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
4.3.5-3.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade isc-dhcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider implementing a temporary workaround by monitoring the number of active OMAPI connections and restarting the DHCP server when the number approaches the maximum limit. This can help mitigate the impact of the vulnerability until a proper fix is applied.
Conclusion
CVE-2017-3144 is a significant vulnerability in ISC DHCP that can lead to socket descriptor exhaustion, impacting network functionality. Users are urged to upgrade to a secure version to protect their systems. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to issues without needing access to the code.
See every vulnerability recorded for isc-dhcp →
FAQ
CVE-2017-3144 is a vulnerability in ISC DHCP that can lead to socket descriptor exhaustion due to improper cleanup of closed OMAPI connections.
The affected versions include ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, and 4.3.0 to 4.3.6.
The vulnerability can cause the DHCP server to exhaust its available socket descriptors, leading to an inability to accept new connections and potential network outages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
It is recommended to upgrade to ISC DHCP version 4.3.5-3.1 or later to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for isc-dhcp.
