CVE-2022-2928: An option refcount overflow exists in dhcpd

Description

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Adjacent

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 53% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

ID

ISC DHCP · ISC

4.4.0 through versions before 4.4.3-P1; 4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1 · source: vendor

DL

Debian Linux · Debian

10.0 · source: NVD

DH

Dhcp · Isc

4.4.0 through 4.4.3; 4.1-esv; 4.1-esv; 4.1-esv; 4.1-esv; 4.1-esv; +24 more · source: NVD

FE

Fedora · Fedoraproject

35; 36; 37 · source: NVD