CVE-2017-3144: ISC DHCP OMAPI connection cleanup failure exhausts socket descriptors

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable, no authentication or interaction required per the vector, and a high EPSS score, but impact is availability-only denial of service rather than code execution or data compromise.

What it is

ISC DHCP fails to properly clean up closed OMAPI connections, so socket descriptors are not released back to the server's pool. Repeated connections eventually exhaust the descriptor pool and the DHCP server can no longer serve clients. The flaw affects ISC DHCP 4.1.0 through 4.1-ESV-R15, 4.2.0 through 4.2.8, and 4.3.0 through 4.3.6, with older EOL releases possibly affected but untested.

Impact

An attacker can drive the DHCP server into socket descriptor exhaustion, causing a denial of service that stops DHCP lease assignment for legitimate clients. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

The CVSS vector is network reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), meaning the OMAPI interface is the likely path if it is exposed. OMAPI is normally bound to a management address and protected by an OMAPI key, so practical reachability depends on whether that interface is exposed and whether credentials are required; the record does not state this explicitly.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.727 probability (99.4th percentile), and all references are vendor or third-party advisories with no public exploit or PoC tags, so exploitation is plausible but not confirmed in the record.

What to do

• Upgrade ISC DHCP to a fixed release per the vendor advisory (kb.isc.org aa-01541) and apply the Red Hat, Ubuntu and Debian errata for packaged versions.
• Restrict OMAPI to trusted management networks with firewall rules and do not expose the OMAPI port to untrusted networks.
• Require and rotate OMAPI authentication keys, and disable OMAPI entirely on servers that do not need it.
• Monitor DHCP server socket descriptor usage and set alerting thresholds so exhaustion is caught before service fails.
• Plan for migration off end-of-life ISC DHCP branches, since older releases are untested and unsupported.

Detection

• Track open socket descriptor counts and file descriptor limits on DHCP servers for sustained growth or near-limit conditions.
• Alert on spikes in OMAPI connection attempts or repeated short-lived connections from a single source.
• Monitor DHCP service availability and lease assignment failures for signs of descriptor exhaustion.
• Review DHCP and OMAPI logs for connection errors or refused connections preceding an outage.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.