CVE-2022-2928
Fixed in a distro release EPSS <1%CVSS 6.5
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.
Products: ISC DHCP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:8 | dhcp-client | 12:4.3.6-49.el8 |
| AlmaLinux:8 | dhcp-common | 12:4.3.6-49.el8 |
| AlmaLinux:8 | dhcp-libs | 12:4.3.6-49.el8 |
| AlmaLinux:8 | dhcp-relay | 12:4.3.6-49.el8 |
| AlmaLinux:8 | dhcp-server | 12:4.3.6-49.el8 |
| AlmaLinux:9 | dhcp-client | 12:4.4.2-18.b1.el9 |
| AlmaLinux:9 | dhcp-common | 12:4.4.2-18.b1.el9 |
| AlmaLinux:9 | dhcp-relay | 12:4.4.2-18.b1.el9 |
| AlmaLinux:9 | dhcp-server | 12:4.4.2-18.b1.el9 |
| Alpine:v3.13 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.14 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.15 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.16 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.17 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.18 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.19 | dhcp | 4.4.3_p1-r0 |
| Alpine:v3.20 | dhcp | 4.4.3_p1-r0 |
| Debian:10 | isc-dhcp | 4.4.1-2+deb10u2 |
| Debian:11 | isc-dhcp | 4.4.1-2.3+deb11u1 |
| Debian:12 | isc-dhcp | 4.4.3-2.1 |
| Debian:13 | isc-dhcp | 4.4.3-2.1 |
| Red Hat:enterprise_linux:8 | dhcp | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-client | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-client-debuginfo | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-common | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-debuginfo | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-debugsource | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-libs | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-libs-debuginfo | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-relay | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-relay-debuginfo | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-server | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:8 | dhcp-server-debuginfo | 12:4.3.6-49.el8 |
| Red Hat:enterprise_linux:9 | dhcp | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-client | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-client-debuginfo | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-common | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-debuginfo | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-debugsource | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-relay | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-relay-debuginfo | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-server | 12:4.4.2-18.b1.el9 |
| Red Hat:enterprise_linux:9 | dhcp-server-debuginfo | 12:4.4.2-18.b1.el9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP3 | dhcp | 4.3.6.P1-150000.6.17.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP4 | dhcp | 4.3.6.P1-150000.6.17.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP3 | dhcp | 4.3.6.P1-150000.6.17.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP4 | dhcp | 4.3.6.P1-150000.6.17.1 |
| SUSE:Linux Enterprise Server 12 SP5 | dhcp | 4.3.3-10.28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | dhcp | 4.3.3-10.28.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | dhcp | 4.3.3-10.28.1 |
| Ubuntu:18.04:LTS | isc-dhcp | 4.3.5-3ubuntu7.4 |
| Ubuntu:20.04:LTS | isc-dhcp | 4.4.1-2.1ubuntu5.20.04.4 |
| Ubuntu:22.04:LTS | isc-dhcp | 4.4.1-2.3ubuntu2.3 |
| Ubuntu:Pro:14.04:LTS | isc-dhcp | 4.2.4-7ubuntu12.13+esm2 |
| Ubuntu:Pro:16.04:LTS | isc-dhcp | 4.3.3-5ubuntu12.10+esm2 |
| openSUSE:Leap 15.3 | dhcp | 4.3.6.P1-150000.6.17.1 |
| openSUSE:Leap 15.4 | dhcp | 4.3.6.P1-150000.6.17.1 |
| openSUSE:Tumbleweed | dhcp | 4.4.2.P1-11.1 |