CVE-2022-2928
An option refcount overflow exists in dhcpd
- Published
- Updated
- Reserved
- Assigned by
- isc
Description
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| iscCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.71% · top 46% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
- A DHCP server configured with allow leasequery;, a remote machine with access to the server can send lease queries for the same lease multiple times, leading to the add_option() function being repeatedly called. This could cause an option's refcount field to overflow and the server to abort. Internally, reference counters are integers and thus overflow at 2^31 references, so even at 1000 lease query responses per second, it would take more than three weeks to crash the server. Affects In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1
- CWE-476 (opens in a new tab)All about CWE-476 and its CVEs
Affected products
What to do
Solution: Upgrade to the patched release most closely related to your current version of ISC DHCP. These can all be downloaded from https://www.isc.org/downloads. 4.4.3-P1 4.1-ESV-R16-P2
Workaround: Disable lease query on the server for DHCPv4 or restart the server periodically.
Exploitation: We are not aware of any active exploits.
References (6)
- https://kb.isc.org/docs/cve-2022-2928 (opens in a new tab)x_transferred
- [debian-lts-announce] 20221010 [SECURITY] [DLA 3146-1] isc-dhcp security update (opens in a new tab)mailing-listx_transferred
- FEDORA-2022-f5a45757df (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-9ca9a94e28 (opens in a new tab)vendor-advisoryx_transferred
- FEDORA-2022-c4f274a54f (opens in a new tab)vendor-advisoryx_transferred
- GLSA-202305-22 (opens in a new tab)vendor-advisoryx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-2928)Record last updated .