ID

VAR-202105-1325

CVE

CVE-2021-25217

TITLE

ISC DHCP  buffer overflow vulnerability in

DESCRIPTION

In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted. ISC (Internet Systems Consortium) Provided by ISC DHCP contains a buffer overflow vulnerability. ISC DHCP contains a buffer overflow vulnerability due to a discrepancy between the processing of optional information encapsulated within network packets and information stored on disk. There is a discrepancy between the code that handles encapsulated option information in leases transmitted "on the wire" and the code which reads and parses lease information after it has been written to disk storage. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability. (CVE-2021-25217). Bugs fixed (https://bugzilla.redhat.com/): 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve 1945703 - "Guest OS Info" availability in VMI describe is flaky 1958816 - [2.6.z] KubeMacPool fails to start due to OOM likely caused by a high number of Pods running in the cluster 1963275 - migration controller null pointer dereference 1965099 - Live Migration double handoff to virt-handler causes connection failures 1965181 - CDI importer doesn't report AwaitingVDDK like it used to 1967086 - Cloning DataVolumes between namespaces fails while creating cdi-upload pod 1967887 - [2.6.6] nmstate is not progressing on a node and not configuring vlan filtering that causes an outage for VMs 1969756 - Windows VMs fail to start on air-gapped environments 1970372 - Virt-handler fails to verify container-disk 1973227 - segfault in virt-controller during pdb deletion 1974084 - 2.6.6 containers 1975212 - No Virtual Machine Templates Found [EDIT - all templates are marked as depracted] 1975727 - [Regression][VMIO][Warm] The third precopy does not end in warm migration 1977756 - [2.6.z] PVC keeps in pending when using hostpath-provisioner 1982760 - [v2v] no kind VirtualMachine is registered for version \"kubevirt.io/v1\" i... 1986989 - OpenShift Virtualization 2.6.z cannot be upgraded to 4.8.0 initially deployed starting with <= 4.8 5. 6 ELS) - i386, s390x, x86_64 3. These packages include redhat-release-virtualization-host. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. ========================================================================= Ubuntu Security Notice USN-4969-2 May 27, 2021 isc-dhcp vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: DHCP could be made to crash if it received specially crafted network traffic. Software Description: - isc-dhcp: DHCP server and client Details: USN-4969-1 fixed a vulnerability in DHCP. This update provides the corresponding update for Ubuntu 14.04 ESM and 16.04 ESM. Original advisory details: Jon Franklin and Pawel Wieczorkiewicz discovered that DHCP incorrectly handled lease file parsing. A remote attacker could possibly use this issue to cause DHCP to crash, resulting in a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: isc-dhcp-client 4.3.3-5ubuntu12.10+esm1 isc-dhcp-server 4.3.3-5ubuntu12.10+esm1 Ubuntu 14.04 ESM: isc-dhcp-client 4.2.4-7ubuntu12.13+esm1 isc-dhcp-server 4.2.4-7ubuntu12.13+esm1 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: dhcp security update Advisory ID: RHSA-2021:2415-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2415 Issue date: 2021-06-14 CVE Names: CVE-2021-25217 ===================================================================== 1. Summary: An update for dhcp is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.3) - x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.3) - x86_64 3. Description: The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es): * dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient (CVE-2021-25217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1963258 - CVE-2021-25217 dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.3): Source: dhcp-4.2.5-47.el7_3.2.src.rpm x86_64: dhclient-4.2.5-47.el7_3.2.x86_64.rpm dhcp-4.2.5-47.el7_3.2.x86_64.rpm dhcp-common-4.2.5-47.el7_3.2.x86_64.rpm dhcp-debuginfo-4.2.5-47.el7_3.2.i686.rpm dhcp-debuginfo-4.2.5-47.el7_3.2.x86_64.rpm dhcp-libs-4.2.5-47.el7_3.2.i686.rpm dhcp-libs-4.2.5-47.el7_3.2.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.3): x86_64: dhcp-debuginfo-4.2.5-47.el7_3.2.i686.rpm dhcp-debuginfo-4.2.5-47.el7_3.2.x86_64.rpm dhcp-devel-4.2.5-47.el7_3.2.i686.rpm dhcp-devel-4.2.5-47.el7_3.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-25217 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYMevOtzjgjWX9erEAQjnew/+PuowTw+ecMLl6J0anstu6jdg4vtmfRx3 DSSPxKZglEIKPLEu8/IBbu+FTAMtrS6GSGjHcGkZYkbaF7iTrUlv6h9Si4VEys4K yA29JWy1wYmvvfWKkJeVrRfC8WB9irFxeXL3gFmYUC2EE2i028eUcaPkFWtcTtlY TxQ9NLTNIC0tqJcQibZUlS7Jdv7NFgMlGYe2Mt/f1ddxwzt1TKCg5eBSnnn7ysC0 hHvSt8KFQ4Hq79d06sqgPNKSUz5FDEBncDozpvPNfpLIPUpx/wlK8HslE+IySit/ G2RkE1VTnS86HHcaa/tAf2Rkh9mbvnd8b/kwOW62QSeGuqtLou4KYgvtScgmuoyx NG5HzUq4ly/cuuyxTMLRLuj9ValaLNEKwy2KbiqFuQdUOzYyvsx9R2Pek5h2ID1T d+CQSboecS3tNBr1+CJ+qCofWwGxuSrO3j5aWfafghxh+kbo1iqK42TuOuav/dmz zt/5KcqGMZE4588Sg+CHY6Yh4iY53BRa1886pUU9In+d4XKXDEtCXGAABAtj3hMC fyvSA6mXpKyN6gnhh6yko10LlzYxSNVf/VgRAsyQk8FpPK5RjUhgG48hWNivXiIm TCj1oukZhj2XFXyHHEVSGmpPat9aAhbvOdAJX0CifQUgC+1rnPMZmPj2qBhqQm6j 6yN1IebYnhQ= =NxWC -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . 8.1) - aarch64, noarch, ppc64le, s390x, x86_64 3

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

overflow

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-04-30T02:27:19.379000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE