PublicCVE
Log inSign up

CVE-2022-2928

MEDIUM6.5JSON exportCreate alert

Description

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

CVSS breakdown

CVSS 3.1
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected products

  • ISC / ISC DHCP4.4.0 through versions before 4.4.3-P1 – 4.4.0 through versions before 4.4.3-P1
  • ISC / ISC DHCP4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1 – 4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1

References