CVE-2022-2928: An option refcount overflow exists in dhcpd

Q: What is the severity of CVE-2022-2928?

The severity of CVE-2022-2928 is medium.

Q: What is the affected software of CVE-2022-2928?

The affected software of CVE-2022-2928 is ISC DHCP versions 4.4.0 to 4.4.3 and 4.1-ESV-R1 to 4.1-ESV-R16-P1.

Q: How does CVE-2022-2928 impact ISC DHCP?

CVE-2022-2928 increases the option's refcount field, but does not decrement it, leading to a vulnerability.

Q: How can I fix CVE-2022-2928?

To fix CVE-2022-2928, upgrade to a version of ISC DHCP that is not affected.

Q: Where can I find more information about CVE-2022-2928?

More information about CVE-2022-2928 can be found in the references provided.

Published Oct 4, 2022

Updated

A vulnerability was found in DHCP, where, a DHCP server configured with "allow leasequery;", a remote machine with access to the server can send lease queries for the same lease multiple times, leading to the "addoption()" function being repeatedly called. This could cause an option's "refcount" field to overflow and the server to abort. Internally, reference counters are integers and thus overflow at 2^31 references, so even at 1000 lease query responses per second, it would take more than three weeks to crash the server.

Versions affected:

- 4.1-ESV-R1 -> 4.1-ESV-R16-P1 - 4.4.0 -> 4.4.3

Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series), it is probable, all versions after the introduction of lease query in ISC DHCP 3.0 are affected.

Other sources

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function optioncodehashlookup() is called from addoption(), it increases the option's refcount field. However, there is not a corresponding call to optiondereference() to decrement the refcount field. The function addoption() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

— MITRE

Affected Software

47 affected componentsFixes available

ISC DHCP>=4.4.0<=4.4.3

ISC DHCP=4.1-esv-r1

ISC DHCP=4.1-esv-r10

ISC DHCP=4.1-esv-r10_b1

ISC DHCP=4.1-esv-r10_rc1

ISC DHCP=4.1-esv-r10b1

ISC DHCP=4.1-esv-r10rc1

ISC DHCP=4.1-esv-r11

ISC DHCP=4.1-esv-r11_b1

ISC DHCP=4.1-esv-r11_rc1

ISC DHCP=4.1-esv-r11_rc2

ISC DHCP=4.1-esv-r11b1

ISC DHCP=4.1-esv-r11rc1

ISC DHCP=4.1-esv-r11rc2

ISC DHCP=4.1-esv-r12

ISC DHCP=4.1-esv-r12-p1

ISC DHCP=4.1-esv-r12_b1

ISC DHCP=4.1-esv-r12_p1

ISC DHCP=4.1-esv-r12b1

ISC DHCP=4.1-esv-r13

ISC DHCP=4.1-esv-r13_b1

ISC DHCP=4.1-esv-r13b1

ISC DHCP=4.1-esv-r14

ISC DHCP=4.1-esv-r14_b1

ISC DHCP=4.1-esv-r14b1

ISC DHCP=4.1-esv-r15

ISC DHCP=4.1-esv-r15-p1

ISC DHCP=4.1-esv-r15_b1

ISC DHCP=4.1-esv-r16

ISC DHCP=4.1-esv-r16-p1

Debian Debian Linux=10.0

Fedoraproject Fedora=35

Fedoraproject Fedora=36

Fedoraproject Fedora=37

debian/isc-dhcp

4.4.3-P1-24.4.3-P1-8