CVE-2022-2928 — MEDIUM (6.5)

Vulnerability Description

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Isc	Dhcp	>= 4.4.0, <= 4.4.3
Debian	Debian Linux	10.0
Fedoraproject	Fedora	35

Related Weaknesses (CWE)

CWE-476

References

FAQ

What is CVE-2022-2928?

CVE-2022-2928 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is ...

How severe is CVE-2022-2928?

CVE-2022-2928 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2928?

Check the references section above for vendor advisories and patch information. Affected products include: Isc Dhcp, Debian Debian Linux, Fedoraproject Fedora.