ISC DHCPD up to 4.1-ESV-R16-P1/4.4.3 Server Response option_code_hash_lookup refcount integer overflow

Summaryinfo

A vulnerability has been found in ISC DHCPD up to 4.1-ESV-R16-P1/4.4.3 and classified as critical. Affected by this issue is the function option_code_hash_lookup of the component Server Response Handler. Performing a manipulation of the argument refcount results in integer overflow. This vulnerability is known as CVE-2022-2928. Access to the local network is required for this attack. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in ISC DHCPD up to 4.1-ESV-R16-P1/4.4.3 (Network Management Software). It has been classified as critical. This affects the function option_code_hash_lookup of the component Server Response Handler. The manipulation of the argument refcount with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability. The summary by CVE is:

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

The weakness was published 10/07/2022. It is possible to read the advisory at kb.isc.org. This vulnerability is uniquely identified as CVE-2022-2928 since 08/22/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 211355 (Fedora 37 : dhcp (2022-9ca9a94e28)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.1-ESV-R16-P2 or 4.4.3-P1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211355). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• ISC

Name

• DHCPD

Version

• 4.1-ESV-R16-P1
• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3

License

• open-source

Website

• Vendor: https://www.isc.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion