CVE-2022-2928
An option refcount overflow exists in dhcpd
- State
- Published
- Severity
- 6.5 Medium
- Published
- Oct 7, 2022
- Updated
- Sep 17, 2024
- Reserved
- Aug 22, 2022
Description
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | isc |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
ISC DHCPISC |
|
References
- https://kb.isc.org/docs/cve-2022-2928
- [debian-lts-announce] 20221010 [SECURITY] [DLA 3146-1] isc-dhcp security updatemailing-list
- FEDORA-2022-f5a45757dfvendor-advisory
- FEDORA-2022-9ca9a94e28vendor-advisory
- FEDORA-2022-c4f274a54fvendor-advisory
- GLSA-202305-22vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.