CVE-2017-17141

Vulnerability

A memory leak vulnerability exists in the MPLS Service PING packet processing module of multiple Huawei switch series, including S12700, S1700, S2700, S3700, S5700, S6700, S7700, and S9700. Affected firmware versions span V100R006C03, V200R001C00 through V200R009C00, with specific builds listed per product in the advisory [1]. When the device receives specially crafted malformed MPLS Service PING messages under specific conditions, it fails to release allocated memory during processing, leading to gradual memory exhaustion.

Exploitation

An attacker must be able to send MPLS Service PING messages to the targeted switch. No authentication or prior access is required; the attack vector is network-based. The attacker crafts malformed MPLS Service PING payloads and transmits them to an affected device. Each malformed packet triggers the memory leak, and repeated transmission will cumulatively consume memory until the device runs out of resources.

Impact

Successful exploitation results in memory exhaustion on the affected device. This can cause the switch to become unresponsive, crash, or reboot, resulting in a denial of service (DoS) condition. There is no indication of code execution, privilege escalation, or data compromise beyond the availability impact.

Mitigation

Huawei has released fixed versions: S12700 should be upgraded to V200R008SPH010 or V200R009C00SPC500; other affected models should consult the advisory [1] for the specific resolved version. If patching is not immediately possible, network administrators can restrict access to MPLS Service PING handling (e.g., via ACLs or disabling MPLS OAM) as a temporary workaround. No known exploitation in the wild at the time of disclosure.