Medium: dhcp

Issue Overview:

An integer overflow vulnerability was found in the DHCP server. When the “option_code_hash_lookup()” function is called from “add_option()”, it increases the option’s “refcount” field. However, there is not a corresponding call to “option_dereference()” to decrement the “refcount” field. The “add_option()” function is only used in server responses to lease query packets. Each lease query response calls this function for several options. Hence, a DHCP server configured with “allow lease query” a remote machine with access to the server, can send lease queries for the same lease multiple times, leading to the “add_option()” function being called repeatedly. This issue could cause the reference counters to overflow and the server to abort or crash. (CVE-2022-2928)

A vulnerability was found in the DHCP server where the “fqdn_universe_decode()” function allocates buffer space for the contents of option 81 (fqdn) data received in a DHCP packet. The maximum length of a DNS “label” is 63 bytes. The function tests the length byte of each label contained in the “fqdn”; if it finds a label whose length byte value is larger than 63, it returns without dereferencing the buffer space. This issue causes a memory leak. On a system with access to a DHCP server, an attacker from any adjacent network could send DHCP packets crafted to include “fqdn” labels longer than 63 bytes to the DHCP server, eventually causing the server to run out of memory and crash. (CVE-2022-2929)

Affected Packages:

dhcp

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update dhcp to update your system.

New Packages:

aarch64:  
    dhcp-4.2.5-79.amzn2.1.2.aarch64  
    dhclient-4.2.5-79.amzn2.1.2.aarch64  
    dhcp-common-4.2.5-79.amzn2.1.2.aarch64  
    dhcp-libs-4.2.5-79.amzn2.1.2.aarch64  
    dhcp-devel-4.2.5-79.amzn2.1.2.aarch64  
    dhcp-debuginfo-4.2.5-79.amzn2.1.2.aarch64  
  
i686:  
    dhcp-4.2.5-79.amzn2.1.2.i686  
    dhclient-4.2.5-79.amzn2.1.2.i686  
    dhcp-common-4.2.5-79.amzn2.1.2.i686  
    dhcp-libs-4.2.5-79.amzn2.1.2.i686  
    dhcp-devel-4.2.5-79.amzn2.1.2.i686  
    dhcp-debuginfo-4.2.5-79.amzn2.1.2.i686  
  
src:  
    dhcp-4.2.5-79.amzn2.1.2.src  
  
x86_64:  
    dhcp-4.2.5-79.amzn2.1.2.x86_64  
    dhclient-4.2.5-79.amzn2.1.2.x86_64  
    dhcp-common-4.2.5-79.amzn2.1.2.x86_64  
    dhcp-libs-4.2.5-79.amzn2.1.2.x86_64  
    dhcp-devel-4.2.5-79.amzn2.1.2.x86_64  
    dhcp-debuginfo-4.2.5-79.amzn2.1.2.x86_64  

Additional References

Red Hat: CVE-2022-2928, CVE-2022-2929

Mitre: CVE-2022-2928, CVE-2022-2929