An option refcount overflow exists in dhcpd
Priority LOW 30CWE-476Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.
Why it matters now
EPSS 0.00711 53rd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ISC | ISC DHCP | 4.4.0 through versions before 4.4.3-P1; 4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1 | — | No fix listed | CNA |
- ISC DHCP VendorISC Affected 4.4.0 through versions before 4.4.3-P1; 4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1 Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:* | 4.4.0 – 4.4.3 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r1:*:*:*:*:*:* | 4.1-esv r1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r10:*:*:*:*:*:* | 4.1-esv r10 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r10_b1:*:*:*:*:*:* | 4.1-esv r10_b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r10_rc1:*:*:*:*:*:* | 4.1-esv r10_rc1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r10b1:*:*:*:*:*:* | 4.1-esv r10b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r10rc1:*:*:*:*:*:* | 4.1-esv r10rc1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r11:*:*:*:*:*:* | 4.1-esv r11 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r11_b1:*:*:*:*:*:* | 4.1-esv r11_b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc1:*:*:*:*:*:* | 4.1-esv r11_rc1 | Vulnerable | ISC |
- cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:* Versions 4.4.0 – 4.4.3 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r1:*:*:*:*:*:* Versions 4.1-esv r1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r10:*:*:*:*:*:* Versions 4.1-esv r10 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r10_b1:*:*:*:*:*:* Versions 4.1-esv r10_b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r10_rc1:*:*:*:*:*:* Versions 4.1-esv r10_rc1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r10b1:*:*:*:*:*:* Versions 4.1-esv r10b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r10rc1:*:*:*:*:*:* Versions 4.1-esv r10rc1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r11:*:*:*:*:*:* Versions 4.1-esv r11 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r11_b1:*:*:*:*:*:* Versions 4.1-esv r11_b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc1:*:*:*:*:*:* Versions 4.1-esv r11_rc1 Vulnerable ·ISC
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc2:*:*:*:*:*:* | 4.1-esv r11_rc2 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r11b1:*:*:*:*:*:* | 4.1-esv r11b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r11rc1:*:*:*:*:*:* | 4.1-esv r11rc1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r11rc2:*:*:*:*:*:* | 4.1-esv r11rc2 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r12:*:*:*:*:*:* | 4.1-esv r12 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r12-p1:*:*:*:*:*:* | 4.1-esv r12-p1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r12_b1:*:*:*:*:*:* | 4.1-esv r12_b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r12_p1:*:*:*:*:*:* | 4.1-esv r12_p1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r12b1:*:*:*:*:*:* | 4.1-esv r12b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r13:*:*:*:*:*:* | 4.1-esv r13 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r13_b1:*:*:*:*:*:* | 4.1-esv r13_b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r13b1:*:*:*:*:*:* | 4.1-esv r13b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r14:*:*:*:*:*:* | 4.1-esv r14 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r14_b1:*:*:*:*:*:* | 4.1-esv r14_b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r14b1:*:*:*:*:*:* | 4.1-esv r14b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r15:*:*:*:*:*:* | 4.1-esv r15 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r15-p1:*:*:*:*:*:* | 4.1-esv r15-p1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r15_b1:*:*:*:*:*:* | 4.1-esv r15_b1 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r16:*:*:*:*:*:* | 4.1-esv r16 | Vulnerable | ISC |
| cpe:2.3:a:isc:dhcp:4.1-esv:r16-p1:*:*:*:*:*:* | 4.1-esv r16-p1 | Vulnerable | ISC |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc2:*:*:*:*:*:* Versions 4.1-esv r11_rc2 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r11b1:*:*:*:*:*:* Versions 4.1-esv r11b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r11rc1:*:*:*:*:*:* Versions 4.1-esv r11rc1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r11rc2:*:*:*:*:*:* Versions 4.1-esv r11rc2 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r12:*:*:*:*:*:* Versions 4.1-esv r12 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r12-p1:*:*:*:*:*:* Versions 4.1-esv r12-p1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r12_b1:*:*:*:*:*:* Versions 4.1-esv r12_b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r12_p1:*:*:*:*:*:* Versions 4.1-esv r12_p1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r12b1:*:*:*:*:*:* Versions 4.1-esv r12b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r13:*:*:*:*:*:* Versions 4.1-esv r13 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r13_b1:*:*:*:*:*:* Versions 4.1-esv r13_b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r13b1:*:*:*:*:*:* Versions 4.1-esv r13b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r14:*:*:*:*:*:* Versions 4.1-esv r14 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r14_b1:*:*:*:*:*:* Versions 4.1-esv r14_b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r14b1:*:*:*:*:*:* Versions 4.1-esv r14b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r15:*:*:*:*:*:* Versions 4.1-esv r15 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r15-p1:*:*:*:*:*:* Versions 4.1-esv r15-p1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r15_b1:*:*:*:*:*:* Versions 4.1-esv r15_b1 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r16:*:*:*:*:*:* Versions 4.1-esv r16 Vulnerable ·ISC
- cpe:2.3:a:isc:dhcp:4.1-esv:r16-p1:*:*:*:*:*:* Versions 4.1-esv r16-p1 Vulnerable ·ISC
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
Red Hat 2 advisories
- RHSA-2023:3000 Released 2023-05-16 · Red Hat rating Moderatedhcp security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) dhcp-12:4.3.6-49.el8, dhcp-client-12:4.3.6-49.el8, dhcp-common-12:4.3.6-49.el8 +3
- RHSA-2023:2502 Released 2023-05-09 · Red Hat rating Moderatedhcp security and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 9) dhcp-12:4.4.2-18.b1.el9, dhcp-client-12:4.4.2-18.b1.el9, dhcp-common-12:4.4.2-18.b1.el9 +2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
ISC DHCP — FEDORA-2022-c4f274a54f
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-02709 DHCP memory leakPriority LOW 30
- Advisory ·
ISC DHCP — FEDORA-2022-f5a45757df
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-02709 DHCP memory leakPriority LOW 30
Show 1 more group
- Advisory ·
ISC DHCP — FEDORA-2022-9ca9a94e28
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-02709 DHCP memory leakPriority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:3000 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:2502 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2928
- 2026-10-03 Alias added: GHSA-5fp7-mmwq-gvmw
References
More ISC Dhcp vulnerabilities
- TI-2011-00858 dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and… CVSS 2.0HIGH 7.5
- TI-2017-02364 Failure to properly clean up closed OMAPI connections can exhaust available sockets CVSS 3.1HIGH 7.5
- TI-2015-07072 ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote… CVSS 3.0MEDIUM 6.5
- TI-2016-02318 ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the… CVSS 3.1MEDIUM 5.9
- TI-2009-00661 Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC… CVSS 2.0HIGH 10.0
- TI-2010-02068 ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2022-2928 · CVE Program
- CVE-2022-2928 · NVD
- FIRST EPSS
- GHSA-5fp7-mmwq-gvmw · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2928 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences