Skip to content
Fencer Intel
medium 6.5

CVE-2022-2928 json

An option refcount overflow exists in dhcpd

published 4y ago modified 4mo ago also EUVD-2022-35151

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

Patch / fix

  • isc-dhcp Debian 13, Debian 12 4.4.3-2.1

debian advisories DEBIAN-CVE-2022-2928

  • isc-dhcp Ubuntu 18.04 LTS 4.3.5-3ubuntu7.4
  • isc-dhcp Ubuntu 20.04 LTS 4.4.1-2.1ubuntu5.20.04.4
  • isc-dhcp Ubuntu 22.04 LTS 4.4.1-2.3ubuntu2.3
  • isc-dhcp Ubuntu Pro 14.04 LTS 4.2.4-7ubuntu12.13+esm2
  • isc-dhcp Ubuntu Pro 16.04 LTS 4.3.3-5ubuntu12.10+esm2

ubuntu advisories UBUNTU-CVE-2022-2928

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dhcp RHEL 8 12:4.3.6-49.el8
  • dhcp-libs RHEL 8 12:4.3.6-49.el8
  • dhcp-relay RHEL 8 12:4.3.6-49.el8
  • dhcp-client RHEL 8 12:4.3.6-49.el8
  • dhcp-common RHEL 8 12:4.3.6-49.el8
  • dhcp-server RHEL 8 12:4.3.6-49.el8
  • dhcp RHEL 9 12:4.4.2-18.b1.el9
  • dhcp-relay RHEL 9 12:4.4.2-18.b1.el9

red hat advisories RHSA-2023:3000RHSA-2023:2502

  • dhcp SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 4.3.3-10.28.1
  • dhcp SLE Module for Server Applications 15 SP4, SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP4 +3 more 4.3.6.P1-150000.6.17.1

suse advisories SUSE-SU-2022:3992-1SUSE-SU-2022:3991-1

  • dhcp openSUSE Tumbleweed 4.4.2.P1-11.1

opensuse advisories openSUSE-SU-2024:12390-1

  • dhcp-libs AlmaLinux 8 12:4.3.6-49.el8
  • dhcp-relay AlmaLinux 8 12:4.3.6-49.el8
  • dhcp-client AlmaLinux 8 12:4.3.6-49.el8
  • dhcp-common AlmaLinux 8 12:4.3.6-49.el8
  • dhcp-server AlmaLinux 8 12:4.3.6-49.el8
  • dhcp-relay AlmaLinux 9 12:4.4.2-18.b1.el9
  • dhcp-client AlmaLinux 9 12:4.4.2-18.b1.el9
  • dhcp-common AlmaLinux 9 12:4.4.2-18.b1.el9

almalinux advisories ALSA-2023:3000ALSA-2023:2502

  • dhcp Alpine 3.20, Alpine 3.19, Alpine 3.18 +5 more 4.4.3_p1-r0

alpine advisories ALPINE-CVE-2022-2928

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2022-2928 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2928 updated cvss 6.5

dhcp: option refcount overflow when leasequery is enabled leading to dhcpd abort

  • Red Hat Enterprise Linux 6 dhcp, dhclient, dhcp-common Red Hat Enterprise Linux 7 dhcp, dhclient, dhcp-libs, dhcp-common
    affected: workaround, no fix planned “Possible workaround - Disable lease query on the server for DHCPv4 or restart the server periodically.”
  • Red Hat Enterprise Linux BaseOS (v. 8) dhcp 4.3.6-49.el8, dhcp-libs 4.3.6-49.el8, dhcp-relay 4.3.6-49.el8, dhcp-client 4.3.6-49.el8, dhcp-common 4.3.6-49.el8, dhcp-server 4.3.6-49.el8
    fixed: vendor fix “Possible workaround - Disable lease query on the server for DHCPv4 or restart the server periodically.” RHSA-2023:3000
  • Red Hat Enterprise Linux BaseOS (v. 9) dhcp 4.4.2-18.b1.el9, dhcp-relay 4.4.2-18.b1.el9, dhcp-client 4.4.2-18.b1.el9, dhcp-common 4.4.2-18.b1.el9, dhcp-server 4.4.2-18.b1.el9
    fixed: vendor fix “Possible workaround - Disable lease query on the server for DHCPv4 or restart the server periodically.” RHSA-2023:2502

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • ISC ISC DHCP

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.