PT-2022-7561 · Isc+8 · Isc Dhcp+8

Victorv · Published 2022-09-28 · Updated 2024-06-15 · CVE-2022-2929

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ISC DHCP versions 1.0 through 4.4.3 ISC DHCP 4.1-ESV-R1 through 4.1-ESV-R16-P1

Description The issue is related to unbounded memory allocation in the ISC DHCP package. It can be exploited by a remote attacker to cause a denial of service. Specifically, sending crafted DHCP packets with fqdn labels longer than 63 bytes to a DHCP server can eventually cause the server to run out of memory.

Recommendations For ISC DHCP versions 1.0 through 4.4.3, update to a version outside of this range to resolve the issue. For ISC DHCP 4.1-ESV-R1 through 4.1-ESV-R16-P1, update to a version later than 4.1-ESV-R16-P1 to fix the problem. As a temporary workaround, consider restricting access to the DHCP server to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALSA-2023:2502

ALSA-2023:3000

ALT-PU-2022-2744

ALT-PU-2022-2839

ALT-PU-2023-1273

ALT-PU-2023-6824

BDU:2024-07317

CESA-2023_3000

CVE-2022-2929

DLA-3146-1

DSA-5251-1

MGASA-2022-0374

OESA-2022-2009

OPENSUSE-SU-2022_3991-1

OPENSUSE-SU-2024:12390-1

RHSA-2023:2502

RHSA-2023:3000

RHSA-2023_2502

RHSA-2023_3000

SUSE-SU-2022:3991-1

SUSE-SU-2022:3992-1

USN-5658-1

USN-5658-2

USN-5658-3

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Isc Dhcp

Linuxmint

Red Hat

Suse

Ubuntu

References · 62

• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2929 · Security Note
• https://osv.dev/vulnerability/DSA-5251-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6IBFH4MRRNJQVWEKILQ6I6CXWW766FX · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5658-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07317 · Security Note
• https://ubuntu.com/security/notices/USN-5658-3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2929 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0374 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12390-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-2929 · Vendor Advisory
• https://kb.isc.org/docs/cve-2022-2929 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-3000.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2929 · Vendor Advisory