Critical Vulnerability in ISC DHCP Package: Potential Crash and Service Disruption
Summary
ALPINE-CVE-2021-25217: In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer s... Affects dhcp versions < 4.4.2_p1-r0. Fixed in 4.4.2_p1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ISC DHCP package is a widely used implementation of the Dynamic Host Configuration Protocol (DHCP), which enables network devices to automatically receive IP addresses and other configuration settings. It is essential for maintaining network connectivity and managing IP address allocation in various environments. The package is known for its reliability and flexibility, but it has recently been identified as vulnerable to a critical issue that can lead to service interruptions.
Vulnerability Detail
The vulnerability, identified as CVE-2021-25217, affects ISC DHCP versions 4.1-ESV-R1 to 4.4.2. It arises from improper handling of lease files, which can cause the DHCP client (dhclient) or server (dhcpd) to crash under certain conditions. Specifically, on 32-bit systems, reading an improper lease can lead to a crash of dhclient, disrupting network connectivity. In dhcpd, if built with specific compiler flags, it may exit unexpectedly while parsing a lease file, resulting in service unavailability and potential data loss of lease entries. This vulnerability poses significant risks to network operations, especially in environments relying on DHCP for IP address management.
How To Fix
Minimum fixed version
4.4.2_p1-r0
This is the first release that contains the fix.
sudo apk add --upgrade dhcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict validation of lease files before they are processed by dhclient or dhcpd. Additionally, running the DHCP services on a 64-bit architecture or without the -fstack-protection-strong compiler flag may mitigate the risk of crashes.
Conclusion
The ISC DHCP package is critical for network operations, but the identified vulnerability (CVE-2021-25217) poses significant risks. It is essential to update to the patched version to ensure continued service reliability and prevent potential disruptions. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for dhcp →
FAQ
CVE-2021-25217 is a vulnerability in the ISC DHCP package that can lead to crashes in the DHCP client and server when processing improper lease files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can cause network connectivity issues and service disruptions, particularly on 32-bit systems running dhclient or dhcpd.
Yes, a patched version of the ISC DHCP package (4.4.2_p1-r0) is available. It is recommended to update to this version to mitigate the vulnerability.
If immediate updates are not possible, consider implementing strict validation of lease files and running DHCP services on a 64-bit architecture to reduce the risk of crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for dhcp.
