Skip to content
OpenAdvisories
Medium · 6.5 CVE-2019-6470 EUVD-2019-16030GHSA-w4w8-43xj-r4wr

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

Published Nov 1, 2019 · Updated Sep 17, 2024 · Assigned by isc

Description

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.

Affected products

VendorProductAffectedFixed
Multiple, non-ISC dhcpd builds not wholly from ISC source < 4.4.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 isc-dhcp 4.4.1-2 —
Debian 12 isc-dhcp 4.4.1-2 —
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS isc-dhcp 4.3.5-3ubuntu7.1 USN-3973-1
ReleasePackageFixed inAdvisory
RHEL 8 dhcp +5 12:4.3.6-34.el8 RHSA-2019:3525
RHEL 7 dhcp +4 12:4.2.5-77.el7 RHSA-2019:2060
ReleasePackageFixed inAdvisory
SLES 15 SP1 dhcp 4.3.5-6.3.1 SUSE-SU-2019:2657-1
SLES 15 dhcp 4.3.5-6.3.1 SUSE-SU-2019:2657-1
SLES 12 SP5 dhcp 4.3.3-10.19.1 SUSE-SU-2019:2727-2
SLES 12 SP4 dhcp 4.3.3-10.19.1 SUSE-SU-2019:2727-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 dhcp 4.3.3-10.19.1 SUSE-SU-2019:2727-2
SLES for SAP 12 SP4 dhcp 4.3.3-10.19.1 SUSE-SU-2019:2727-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed dhcp 4.4.2.P1-2.4 openSUSE-SU-2024:10715-1
openSUSE Leap 15.1 dhcp 4.3.5-lp151.6.3.1 openSUSE-SU-2019:2341-1
openSUSE Leap 15.0 dhcp 4.3.5-lp150.5.3.1 openSUSE-SU-2019:2340-1
ReleasePackageFixed inAdvisory
Alpine v3.20 dhcp 4.4.1-r0 —
Alpine v3.19 dhcp 4.4.1-r0 —
Alpine v3.18 dhcp 4.4.1-r0 —
Alpine v3.17 dhcp 4.4.1-r0 —
Alpine v3.16 dhcp 4.4.1-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.15 dhcp 4.4.1-r0 —
Alpine v3.14 dhcp 4.4.1-r0 —
Alpine v3.13 dhcp 4.4.1-r0 —
Alpine v3.12 dhcp 4.4.1-r0 —
Alpine v3.11 dhcp 4.4.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 dhcp +4 12:4.2.5-77.amzn2.1.1 ALAS2-2019-1346

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 bind 9.16.44-2 —
Azure Linux 2 (CBL-Mariner) bind 9.16.15-3 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 dhcp-libs +4 12:4.3.6-34.el8 ELSA-2019-3525
Oracle Linux 7 dhcp +4 12:4.2.5-77.0.1.el7 ELSA-2019-2060

Advisories 12

References