QID 354111

An integer overflow vulnerability was found in the dhcp server.
When the "option_code_hash_lookup()" function is called from "add_option()", it increases the option's "refcount" field.
However, there is not a corresponding call to "option_dereference()" to decrement the "refcount" field.
The "add_option()" function is only used in server responses to lease query packets.
Each lease query response calls this function for several options.
Hence, a dhcp server configured with "allow lease query" a remote machine with access to the server, can send lease queries for the same lease multiple times, leading to the "add_option()" function being called repeatedly.
This issue could cause the reference counters to overflow and the server to abort or crash. (
( CVE-2022-2928) a vulnerability was found in the dhcp server where the "fqdn_universe_decode()" function allocates buffer space for the contents of option 81 (fqdn) data received in a dhcp packet.
The maximum length of a dns "label" is 63 bytes.
The function tests the length byte of each label contained in the "fqdn"; if it finds a label whose length byte value is larger than 63, it returns without dereferencing the buffer space.
This issue causes a memory leak.
On a system with access to a dhcp server, an attacker from any adjacent network could send dhcp packets crafted to include "fqdn" labels longer than 63 bytes to the dhcp server, eventually causing the server to run out of memory and crash. (
( CVE-2022-2929)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.