6.5
Medium
CVE-2022-2928 In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called…
Description
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ISC DHCP | Versions not published |
References
- kb.isc.org kb.isc.org
- [debian-lts-announce] 20221010 [SECURITY] [DLA 3146-1] isc-dhcp security update lists.debian.org
- FEDORA-2022-f5a45757df lists.fedoraproject.org
- FEDORA-2022-9ca9a94e28 lists.fedoraproject.org
- FEDORA-2022-c4f274a54f lists.fedoraproject.org
- GLSA-202305-22 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of ISC DHCP
The 6 CVEs of ISC DHCP →
CVE-2022-2929
In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP…
6.5
Medium
CVE-2021-25217
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the…
7.4
High
CVE-2018-5732
Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity…
7.5
High
CVE-2017-3144
A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool…
5.3
Medium