CVE-2022-2928

Name of the Vulnerable Software and Affected Versions ISC DHCP versions 4.1-ESV-R1 through 4.1-ESV-R16-P1 ISC DHCP versions 4.4.0 through 4.4.3

Description The issue is related to the function add option() in ISC DHCP, which is used in server responses to lease query packets. When option code hash lookup() is called from add option(), it increases the option's refcount field, but there is no corresponding call to option dereference() to decrement the refcount field. This can cause the reference counters to overflow, leading to a server abort. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For ISC DHCP versions 4.1-ESV-R1 through 4.1-ESV-R16-P1, update to a version that includes a fix for the issue. For ISC DHCP versions 4.4.0 through 4.4.3, update to a version that includes a fix for the issue. As a temporary workaround, consider restricting access to the add option() function to minimize the risk of exploitation.