CVE-2022-2929: DHCP memory leak

Q: What is CVE-2022-2929?

CVE-2022-2929 is a vulnerability in ISC DHCP that could allow an attacker to cause the DHCP server to run out of memory.

Q: Which versions of ISC DHCP are affected by CVE-2022-2929?

ISC DHCP versions 1.0 to 4.4.3 and 4.1-ESV-R1 to 4.1-ESV-R16-P1 are affected by CVE-2022-2929.

Q: What is the severity of CVE-2022-2929?

CVE-2022-2929 has a severity score of 6.5, which is considered medium.

Q: How can CVE-2022-2929 be fixed?

To fix CVE-2022-2929, it is recommended to update to a patched version of ISC DHCP.

Q: Where can I find more information about CVE-2022-2929?

More information about CVE-2022-2929 can be found in the references provided: [reference 1](https://kb.isc.org/docs/cve-2022-2929), [reference 2](https://lists.debian.org/debian-lts-announce/2022/10/msg00015.html), [reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2SARIK7KZ7MGQIWDRWZFAOSQSPXY4GOU/)

Published Oct 7, 2022

Updated

In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.

Affected Software

35 affected components

ISC DHCP>=1.0.0<4.1-esv

ISC DHCP>=4.2.0<=4.4.3

ISC DHCP=4.1-esv-r1

ISC DHCP=4.1-esv-r10

ISC DHCP=4.1-esv-r10_b1

ISC DHCP=4.1-esv-r10_rc1

ISC DHCP=4.1-esv-r10b1

ISC DHCP=4.1-esv-r10rc1

ISC DHCP=4.1-esv-r11

ISC DHCP=4.1-esv-r11_b1

ISC DHCP=4.1-esv-r11_rc1

ISC DHCP=4.1-esv-r11_rc2

ISC DHCP=4.1-esv-r11b1

ISC DHCP=4.1-esv-r11rc1

ISC DHCP=4.1-esv-r11rc2

ISC DHCP=4.1-esv-r12

ISC DHCP=4.1-esv-r12-p1

ISC DHCP=4.1-esv-r12_b1

ISC DHCP=4.1-esv-r12_p1

ISC DHCP=4.1-esv-r12b1

ISC DHCP=4.1-esv-r13

ISC DHCP=4.1-esv-r13_b1

ISC DHCP=4.1-esv-r13b1

ISC DHCP=4.1-esv-r14

ISC DHCP=4.1-esv-r14_b1

ISC DHCP=4.1-esv-r14b1

ISC DHCP=4.1-esv-r15

ISC DHCP=4.1-esv-r15-p1

ISC DHCP=4.1-esv-r15_b1

ISC DHCP=4.1-esv-r16

ISC DHCP=4.1-esv-r16-p1

Debian Debian Linux=10.0

Fedoraproject Fedora=35

Fedoraproject Fedora=36

Fedoraproject Fedora=37

Remediation

Information

Upgrade to the patched release most closely related to your current version of ISC DHCP. These can all be downloaded from https://www.isc.org/downloads. 4.4.3-P1 4.1-ESV-R16-P2

Event History

Oct 7, 2022

CVE Published

via MITRE·04:45 AM

Data Sourced

via MITRE·04:45 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-2929?

CVE-2022-2929 is a vulnerability in ISC DHCP that could allow an attacker to cause the DHCP server to run out of memory.

Which versions of ISC DHCP are affected by CVE-2022-2929?

ISC DHCP versions 1.0 to 4.4.3 and 4.1-ESV-R1 to 4.1-ESV-R16-P1 are affected by CVE-2022-2929.

What is the severity of CVE-2022-2929?