A Critical Flaw Allows Hacking Your Linux Machines With Just A Malicious DNS Response

A critical flaw has been discovered in Systemd-resolved in Ubuntu, which is possible to trigger with a specially crafted TCP payload. Chris Coulson, Ubuntu developer at Canonical, has recently discovered this Linux vulnerability that can be exploited to remotely hack machines running the popular OS. The flaw, identified as CVE-2017-9445, actually resides in the ‘dns_packet_new’ function of Systemd, the init system and service manager for Linux operating systems. With this flaw, a remote attacker can potentially trigger the buffer overflow vulnerability to execute malicious code on the targeted machines via a DNS response.

According to an advisory published on June 27, a specially crafted malicious DNS response can crash ‘systemd-resolved’ program remotely every time the system tries to lookup for a hostname on an attacker-controlled DNS service.  Eventually, large DNS response overflows the buffer, allowing an attacker to overwrite the memory which leads to remote code execution. This means the attackers can remotely run any malware on the targeted system or server via their evil DNS service.

“Certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that’s too small. A page-aligned number – sizeof(DnsPacket) + sizeof(iphdr) + sizeof(udphdr) will do this – so, on x86 this will be a page-aligned number – 80. Eg, calling dns_packet_new with a size of 4016 on x86 will result in an allocation of 4096 bytes, but 108 bytes of this are for the DnsPacket struct.” reads Canonical’s security advisory.

“A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that’s too small, and subsequently write arbitrary data beyond the end of it,” explained Chris Coulson.

According to Coulson, this vulnerability was present since Systemd version 223 introduced in June 2015 and affects all subsequent versions up to and including v23 launched in March this year.

Security Patches:

In the security report, Canonical says that the systemd vulnerability affects the Ubuntu 17.04 and 16.10 versions, as well as all of its official derivatives. Security patches have been released to address the issue, so Linux users and system administrators are strongly recommended to install them and update their Linux systems immediately.

Ubuntu 17.04 users need to update to systemd 232-21ubuntu5 and Ubuntu 16.10 users to systemd231-9ubuntu5.