An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
Weakness
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Systemd | Systemd_project | 245 (including) | 245 (including) |
| Red Hat Enterprise Linux 8 | RedHat | NetworkManager-1:1.32.10-4.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | NetworkManager-1:1.32.10-4.el8 | * |
| Systemd | Ubuntu | bionic | * |
| Systemd | Ubuntu | devel | * |
| Systemd | Ubuntu | esm-infra-legacy/trusty | * |
| Systemd | Ubuntu | esm-infra/bionic | * |
| Systemd | Ubuntu | esm-infra/focal | * |
| Systemd | Ubuntu | esm-infra/xenial | * |
| Systemd | Ubuntu | focal | * |
| Systemd | Ubuntu | groovy | * |
| Systemd | Ubuntu | hirsute | * |
| Systemd | Ubuntu | impish | * |
| Systemd | Ubuntu | jammy | * |
| Systemd | Ubuntu | kinetic | * |
| Systemd | Ubuntu | lunar | * |
| Systemd | Ubuntu | mantic | * |
| Systemd | Ubuntu | noble | * |
| Systemd | Ubuntu | oracular | * |
| Systemd | Ubuntu | plucky | * |
| Systemd | Ubuntu | questing | * |
| Systemd | Ubuntu | trusty | * |
| Systemd | Ubuntu | trusty/esm | * |
| Systemd | Ubuntu | xenial | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/21.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/459.html
- https://cwe.mitre.org/data/definitions/461.html
- https://cwe.mitre.org/data/definitions/473.html
- https://cwe.mitre.org/data/definitions/476.html
- https://cwe.mitre.org/data/definitions/59.html
- https://cwe.mitre.org/data/definitions/60.html
- https://cwe.mitre.org/data/definitions/667.html
- https://cwe.mitre.org/data/definitions/94.html
References
- http://www.openwall.com/lists/oss-security/2021/08/04/2
- http://www.openwall.com/lists/oss-security/2021/08/17/3
- http://www.openwall.com/lists/oss-security/2021/09/07/3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/
- https://security.gentoo.org/glsa/202107-48
- https://security.netapp.com/advisory/ntap-20210625-0005/
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142
- http://www.openwall.com/lists/oss-security/2021/08/04/2
- http://www.openwall.com/lists/oss-security/2021/08/17/3
- http://www.openwall.com/lists/oss-security/2021/09/07/3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/
- https://security.gentoo.org/glsa/202107-48
- https://security.netapp.com/advisory/ntap-20210625-0005/
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142