Vulnerability record · CVE-2017-13704 · published 3 October 2017
CVE-2017-13704: dnsmasq DNS packet size mismatch causes memset crash
Canonical · Ubuntu Linux
In dnsmasq before 2.78, a DNS packet whose size does not match the expected size causes the size parameter in a memset call to become negative. Because the value is unsigned, memset writes up to 0xffffffff zero bytes (0xffffffffffffffff on 64-bit platforms), crashing dnsmasq. The flaw is an input validation failure in a widely deployed DNS/DHCP forwarder, so a crash takes down name resolution for everything relying on it.
Description
In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote crash of a core DNS/DHCP service with a high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
In dnsmasq before 2.78, a DNS packet whose size does not match the expected size causes the size parameter in a memset call to become negative. Because the value is unsigned, memset writes up to 0xffffffff zero bytes (0xffffffffffffffff on 64-bit platforms), crashing dnsmasq. The flaw is an input validation failure in a widely deployed DNS/DHCP forwarder, so a crash takes down name resolution for everything relying on it.
Impact
An attacker can crash the dnsmasq process, causing a denial of service for DNS and DHCP services it provides. No data confidentiality or integrity impact is described; the effect is availability loss.
Attack surface
Reachable over the network by sending a crafted DNS packet with a mismatched size, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at 0.6541 (99.2nd percentile), indicating elevated likelihood of exploitation activity. References are vendor advisories, release notes and third-party analyses rather than public exploit code.
What to do
- Upgrade dnsmasq to 2.78 or later, or apply the vendor patch for your distribution (Ubuntu, Debian, Fedora, Red Hat, Novell/SUSE, Synology).
- If immediate patching is not possible, restrict DNS access to trusted networks and block untrusted UDP/TCP port 53 traffic at the perimeter.
- Monitor dnsmasq process health and configure automatic restart of the service to limit outage duration.
- Inventory all dnsmasq instances, including embedded and appliance deployments, since the affected products list spans multiple vendors.
Detection
- Alert on dnsmasq process crashes or unexpected restarts in system and service logs.
- Monitor for repeated or malformed DNS queries with anomalous packet sizes targeting port 53.
- Track availability gaps in DNS resolution from monitoring probes to catch crash-induced outages.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-13704 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-13704), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
