Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-14495 — Missing Release of Resource after Effective Lifetime in Dnsmasq

CWE-772 — Missing Release of Resource after Effective LifetimeCWE-400 — Uncontrolled Resource Consumption11 documents9 sources
Severity
7.5HIGHNVD
EPSS
53.3%
top 2.02%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
6
Thekelleys DnsmasqCanonical Ubuntu LinuxDebian Linux+3 more
Timeline
PublishedOct 3
Latest updateMay 13

Description

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Debianthekelleys/dnsmasq< 2.78-1+3

Also affects: Debian Linux 7.0, 7.1, 9.0, Ubuntu Linux 14.04, 16.04, 17.04

Patches

Patch: access.redhat.com ↗Patch: access.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-rcfc-xq5g-7phm: Memory leak in dnsmasq before 2↗2022-05-13
▶
OSV
CVE-2017-14495: Memory leak in dnsmasq before 2↗2017-10-03
▶
CVEList
CVE-2017-14495: Memory leak in dnsmasq before 2↗2017-10-02
▶

💥Exploits & PoCs

1
Exploit-DB
Dnsmasq < 2.78 - Lack of free() Denial of Service↗2017-10-02
▶

📋Vendor Advisories

4
Ubuntu
Dnsmasq vulnerabilities↗2017-10-03
▶
Red Hat
dnsmasq: memory exhaustion vulnerability in the EDNS0 code↗2017-10-02
▶
Ubuntu
Dnsmasq vulnerabilities↗2017-10-02
▶
Debian
CVE-2017-14495: dnsmasq - Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-su...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 dnsmasq: various flaws [fedora-all]↗2017-10-02
▶
Bugzilla
CVE-2017-14495 dnsmasq: memory exhaustion vulnerability in the EDNS0 code↗2017-09-26
▶
CVE-2017-14495 — Thekelleys Dnsmasq vulnerability | cvebase