CVE-2017-9445
HighIn systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small.
Published Jun 28, 2017 · Updated Aug 7, 2026 · Also known as DEBIAN-CVE-2017-9445, SUSE-SU-2017:1898-1, UBUNTU-CVE-2017-9445
Key Facts
Patch immediately- CVE-2017-9445 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Systemd (Systemd Project), rootio-systemd, dracut (suse) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 55% probability of exploitation in the next 30 days.
- Fixed versions are available, including dracut 044.1-109.8.3, dracut-fips 044.1-109.8.3, libsystemd0 228-150.7.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
55%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2017-9445 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it.
Affected Products
130 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SystemdSystemd Project | See advisory | 233 |
| rootio-systemdrootio | See advisory | 233-10 |
| dracutsuse | See advisory | 044.1-109.8.3 |
| dracut-fipssuse | See advisory | 044.1-109.8.3 |
| libsystemd0-32bitsuse | See advisory | 249.4-2.2 |
Patched Releases
dracut
044.1-109.8.3
dracut-fips
044.1-109.8.3
libsystemd0
228-150.7.1, 228-150.9.3, 249.4-2.2
libsystemd0-32bit
228-150.7.1, 228-150.9.3, 249.4-2.2
libudev-devel
228-150.7.1, 228-150.9.3, 249.4-2.2
libudev-devel-32bit
249.4-2.2
libudev1
228-150.7.1, 228-150.9.3, 249.4-2.2
libudev1-32bit
228-150.7.1, 228-150.9.3, 249.4-2.2
nss-myhostname
249.4-2.2
nss-myhostname-32bit
249.4-2.2
nss-mymachines
249.4-2.2
nss-mymachines-32bit
249.4-2.2
nss-resolve
249.4-2.2
nss-systemd
249.4-2.2
rootio-systemd
233-10
Systemd
228-150.7.1, 228-150.9.3, 228-35.ph1, 229-4ubuntu19, 233-10, 233-6, 233-9.ph2, 249.4-2.2, NA, 233
systemd-32bit
228-150.7.1, 228-150.9.3, 249.4-2.2
systemd-bash-completion
228-150.7.1, 228-150.9.3
systemd-container
249.4-2.2
systemd-coredump
249.4-2.2
systemd-devel
228-150.7.1, 228-150.9.3, 249.4-2.2
systemd-doc
249.4-2.2
systemd-experimental
249.4-2.2
systemd-journal-remote
249.4-2.2
systemd-lang
249.4-2.2
Timeline
Publicly disclosed
Jun 28, 2017
Last updated
Aug 7, 2026
Weakness Type
- CWE-787 Out-of-bounds Write
References
- advisoryhttps://bugzilla.suse.com/1004995
- advisoryhttps://bugzilla.suse.com/1029102
- advisoryhttps://bugzilla.suse.com/1029516
- advisoryhttps://bugzilla.suse.com/1032029
- advisoryhttps://bugzilla.suse.com/1033238
FAQ
Common Questions.
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small.
Affected: Systemd (Systemd Project); rootio-systemd; dracut (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including dracut 044.1-109.8.3, dracut-fips 044.1-109.8.3, libsystemd0 228-150.7.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-9445 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo