Vulnerability · Published Oct 7, 2022 · Assigned by isc

CVE-2022-2928An option refcount overflow exists in dhcpd

Medium 6.5

In plain English

A medium-severity security flaw in ISC DHCP from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.7%top 46.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	dhcp-client	12:4.3.6-49.el8	ALSA-2023:3000
AlmaLinux:9	dhcp-client	12:4.4.2-18.b1.el9	ALSA-2023:2502
AlmaLinux:8	dhcp-common	12:4.3.6-49.el8	ALSA-2023:3000
AlmaLinux:9	dhcp-common	12:4.4.2-18.b1.el9	ALSA-2023:2502
AlmaLinux:8	dhcp-libs	12:4.3.6-49.el8	ALSA-2023:3000
AlmaLinux:8	dhcp-relay	12:4.3.6-49.el8	ALSA-2023:3000
AlmaLinux:9	dhcp-relay	12:4.4.2-18.b1.el9	ALSA-2023:2502
AlmaLinux:8	dhcp-server	12:4.3.6-49.el8	ALSA-2023:3000
AlmaLinux:9	dhcp-server	12:4.4.2-18.b1.el9	ALSA-2023:2502
Alpine:v3.20	dhcp	4.4.3_p1-r0	ALPINE-CVE-2022-2928
Debian:12	isc-dhcp	4.4.3-2.1	DEBIAN-CVE-2022-2928
Debian:13	isc-dhcp	4.4.3-2.1	DEBIAN-CVE-2022-2928
Ubuntu:22.04:LTS	isc-dhcp	4.4.1-2.3ubuntu2.3	USN-5658-1
Ubuntu:22.04:LTS	isc-dhcp	4.4.1-2.3ubuntu2.3	UBUNTU-CVE-2022-2928

Affected products (as reported)

Vendor	Product	Versions
ISC	ISC DHCP	4.4.0 through versions before 4.4.3-P14.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1

References

https://kb.isc.org/docs/cve-2022-2928
[debian-lts-announce] 20221010 [SECURITY] [DLA 3146-1] isc-dhcp security update mailing-list
FEDORA-2022-f5a45757df vendor-advisory
FEDORA-2022-9ca9a94e28 vendor-advisory
FEDORA-2022-c4f274a54f vendor-advisory
GLSA-202305-22 vendor-advisory