CVE-2022-2928 — An option refcount overflow exists in dhcpd

Description

In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dereference() to decrement the refcount field. The function add_option() is only used in server responses to lease query packets. Each lease query response calls this function for several options, so eventually, the reference counters could overflow and cause the server to abort.

Affected products

Vendor	Product	Affected	Fixed
ISC	ISC DHCP	4.4.0 through versions before 4.4.3-P1, 4.1 ESV 4.1-ESV-R1 through versions before 4.1-ESV-R16-P1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	isc-dhcp	4.4.3-2.1	—
Debian 12	isc-dhcp	4.4.3-2.1	—
Debian 11	isc-dhcp	4.4.1-2.3+deb11u1	DSA-5251-1
Debian 10	isc-dhcp	4.4.1-2+deb10u2	DLA-3146-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	isc-dhcp	4.4.1-2.3ubuntu2.3	USN-5658-1
Ubuntu 20.04 LTS	isc-dhcp	4.4.1-2.1ubuntu5.20.04.4	USN-5658-1
Ubuntu 18.04 LTS	isc-dhcp	4.3.5-3ubuntu7.4	USN-5658-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	isc-dhcp	4.3.3-5ubuntu12.10+esm2	USN-5658-2
Ubuntu Pro 14.04 LTS	isc-dhcp	4.2.4-7ubuntu12.13+esm2	USN-5658-3

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	dhcp +4	12:4.4.2-18.b1.el9	RHSA-2023:2502
RHEL 8	dhcp +5	12:4.3.6-49.el8	RHSA-2023:3000

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	dhcp-relay +3	12:4.4.2-18.b1.el9	ALSA-2023:2502
AlmaLinux 8	dhcp-libs +4	12:4.3.6-49.el8	ALSA-2023:3000

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	dhcp	4.3.6.P1-150000.6.17.1	SUSE-SU-2022:3991-1
SLES 15 SP3	dhcp	4.3.6.P1-150000.6.17.1	SUSE-SU-2022:3991-1
SLES 12 SP5	dhcp	4.3.3-10.28.1	SUSE-SU-2022:3992-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP5	dhcp	4.3.3-10.28.1	SUSE-SU-2022:3992-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	dhcp	4.4.2.P1-11.1	openSUSE-SU-2024:12390-1
openSUSE Leap 15.4	dhcp	4.3.6.P1-150000.6.17.1	SUSE-SU-2022:3991-1
openSUSE Leap 15.3	dhcp	4.3.6.P1-150000.6.17.1	SUSE-SU-2022:3991-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.20	dhcp	4.4.3_p1-r0	—
Alpine v3.19	dhcp	4.4.3_p1-r0	—
Alpine v3.18	dhcp	4.4.3_p1-r0	—
Alpine v3.17	dhcp	4.4.3_p1-r0	—
Alpine v3.16	dhcp	4.4.3_p1-r0	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.15	dhcp	4.4.3_p1-r0	—
Alpine v3.14	dhcp	4.4.3_p1-r0	—
Alpine v3.13	dhcp	4.4.3_p1-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	dhcp +4	12:4.2.5-79.amzn2.1.2	ALAS2-2022-1874

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	dhcp-relay +3	12:4.4.2-18.b1.el9	ELSA-2023-2502
Oracle Linux 8	dhcp-libs +4	12:4.3.6-49.el8	ELSA-2023-3000

Advisories 19

ALSA-2023:2502 Moderate: dhcp security and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2023:3000 Moderate: dhcp security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2023:3000 Red Hat Security Advisory: dhcp security and bug fix update Red Hat Security Advisories (RHSA) · Jul 3, 2026
RHSA-2023:2502 Red Hat Security Advisory: dhcp security and enhancement update Red Hat Security Advisories (RHSA) · Jul 3, 2026
USN-5658-3 isc-dhcp vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
USN-5658-2 isc-dhcp vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-5658-1 isc-dhcp vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
DSA-5251-1 isc-dhcp - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3146-1 isc-dhcp - security update Debian Security (DSA / DLA) · Mar 9, 2026
openSUSE-SU-2024:12390-1 dhcp-4.4.2.P1-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3991-1 Security update for dhcp SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3992-1 Security update for dhcp SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
SCA-2025-0011 Vulnerabilities affecting Endress+Hauser SSG-E210GC SICK PSIRT · Oct 2, 2025
SCA-2025-0009 Vulnerabilities affecting SICK TDC-E210GC SICK PSIRT · Aug 1, 2025
WID-SEC-2022-1634 Internet Systems Consortium DHCP: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 23, 2023
ELSA-2023-3000 Moderate: dhcp security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2023
ELSA-2023-2502 Moderate: dhcp security and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
ALAS2-2022-1874 Moderate: dhcp security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 8, 2022

References

https://kb.isc.org/docs/cve-2022-2928
[debian-lts-announce] 20221010 [SECURITY] [DLA 3146-1] isc-dhcp security update mailing-list
FEDORA-2022-f5a45757df vendor-advisory
FEDORA-2022-9ca9a94e28 vendor-advisory
FEDORA-2022-c4f274a54f vendor-advisory
GLSA-202305-22 vendor-advisory

CNA	v3.1	6.5
EUVD	v3.1	6.5