Amazon Linux 2 Security Advisory: ALAS-2022-1874
Advisory Release Date: 2022-10-31 19:40 Pacific
Advisory Updated Date: 2022-11-08 22:20 Pacific
An integer overflow vulnerability was found in the DHCP server. When the "option_code_hash_lookup()" function is called from "add_option()", it increases the option's "refcount" field. However, there is not a corresponding call to "option_dereference()" to decrement the "refcount" field. The "add_option()" function is only used in server responses to lease query packets. Each lease query response calls this function for several options. Hence, a DHCP server configured with "allow lease query" a remote machine with access to the server, can send lease queries for the same lease multiple times, leading to the "add_option()" function being called repeatedly. This issue could cause the reference counters to overflow and the server to abort or crash. (CVE-2022-2928)
A vulnerability was found in the DHCP server where the "fqdn_universe_decode()" function allocates buffer space for the contents of option 81 (fqdn) data received in a DHCP packet. The maximum length of a DNS "label" is 63 bytes. The function tests the length byte of each label contained in the "fqdn"; if it finds a label whose length byte value is larger than 63, it returns without dereferencing the buffer space. This issue causes a memory leak. On a system with access to a DHCP server, an attacker from any adjacent network could send DHCP packets crafted to include "fqdn" labels longer than 63 bytes to the DHCP server, eventually causing the server to run out of memory and crash. (CVE-2022-2929)
Affected Packages:
dhcp
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update dhcp to update your system.
aarch64:
dhcp-4.2.5-79.amzn2.1.2.aarch64
dhclient-4.2.5-79.amzn2.1.2.aarch64
dhcp-common-4.2.5-79.amzn2.1.2.aarch64
dhcp-libs-4.2.5-79.amzn2.1.2.aarch64
dhcp-devel-4.2.5-79.amzn2.1.2.aarch64
dhcp-debuginfo-4.2.5-79.amzn2.1.2.aarch64
i686:
dhcp-4.2.5-79.amzn2.1.2.i686
dhclient-4.2.5-79.amzn2.1.2.i686
dhcp-common-4.2.5-79.amzn2.1.2.i686
dhcp-libs-4.2.5-79.amzn2.1.2.i686
dhcp-devel-4.2.5-79.amzn2.1.2.i686
dhcp-debuginfo-4.2.5-79.amzn2.1.2.i686
src:
dhcp-4.2.5-79.amzn2.1.2.src
x86_64:
dhcp-4.2.5-79.amzn2.1.2.x86_64
dhclient-4.2.5-79.amzn2.1.2.x86_64
dhcp-common-4.2.5-79.amzn2.1.2.x86_64
dhcp-libs-4.2.5-79.amzn2.1.2.x86_64
dhcp-devel-4.2.5-79.amzn2.1.2.x86_64
dhcp-debuginfo-4.2.5-79.amzn2.1.2.x86_64