CVE-2022-2928

MEDIUM 6.5

An option refcount overflow exists in dhcpd

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

Vendor	isc
Product	isc dhcp
Published	Oct 7, 2022
Last Updated	Sep 17, 2024

Stay Ahead of the Next One

Get instant alerts for isc isc dhcp

Be the first to know when new medium vulnerabilities affecting isc isc dhcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

ISC / ISC DHCP

4.4.0 through versions before 4.4.3-P1 4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

ISC would like to thank VictorV of Cyber Kunlun Lab for discovering and reporting this issue.