Moderate: DHCP Security and Bug Fix Update
Summary
ALSA-2023:3000: Moderate: dhcp security and bug fix update. Affects dhcp-client versions < 12:4.3.6-49.el8. Fixed in 12:4.3.6-49.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to obtain their own network configuration information. This includes an IP address, subnet mask, and broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.
Vulnerability Detail
The vulnerability in the DHCP package is twofold:
-
CVE-2022-2928: An option refcount overflow occurs when leasequery is enabled, leading to dhcpd abort. This vulnerability can be exploited to cause a denial of service attack.
-
CVE-2022-2929: A memory leak in DHCP can be exploited to consume excessive memory resources, potentially leading to a system crash or performance degradation.
How To Fix
Minimum fixed version
12:4.3.6-49.el8
This is the first release that contains the fix.
sudo dnf update dhcp-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
In conclusion, the DHCP package is vulnerable to two security issues, CVE-2022-2928 and CVE-2022-2929. These vulnerabilities can lead to denial of service attacks and memory leaks. It is crucial to update the affected packages to version 12:4.3.6-49.el8 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dhcp-client →
FAQ
DHCP is a protocol that allows devices on a network to obtain their network configuration information automatically.
CVE-2022-2928 can be exploited to cause a denial of service attack by triggering a dhcpd abort.
CVE-2022-2929 can lead to excessive memory consumption, potentially causing a system crash or performance degradation.
To fix the vulnerabilities, update the affected packages to version 12:4.3.6-49.el8 or later.
There are no known workarounds for these vulnerabilities. Applying the security update is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for dhcp-client.
