CVE-2022-2929 DHCP memory leak

2022-10-0704:45:12

isc

www.cve.org

cve-2022-2929

isc dhcp

memory leak

access

dhcp server

crafted packets

fqdn labels

memory exhaustion

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

41.3%

JSON

In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.

CNA Affected

[
  {
    "vendor": "ISC",
    "product": "ISC DHCP",
    "versions": [
      {
        "version": "1.0 through versions before 4.1-ESV-R16-P2",
        "status": "affected"
      },
      {
        "version": "4.2 through versions before 4.4.3.-P1",
        "status": "affected"
      }
    ]
  }
]