Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 792324 (CVE-2021-25217) - <net-misc/dhcp-4.4.2_p1: Mishandling of lease information (CVE-2021-25217)
Summary: <net-misc/dhcp-4.4.2_p1: Mishandling of lease information (CVE-2021-25217)
Status: RESOLVED FIXED
Alias: CVE-2021-25217
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://lists.isc.org/pipermail/dhcp-...
Whiteboard: A3 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-26 21:47 UTC by Sam James
Modified: 2023-05-03 11:17 UTC (History)
2 users (show)

See Also:
Package list:
net-misc/dhcp-4.4.2_p1
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-05-26 21:47:20 UTC
Program code used by the ISC DHCP package to read and parse
  stored leases has a defect that can be exploited by an attacker
  to cause one of several undesirable outcomes, depending on the
  component attacked and the way in which it was compiled.

  Because of a discrepancy between the code which handles encapsulated
  option information in leases transmitted "on the wire" and the
  code which reads and parses lease information after it has been
  written to disk storage, it is potentially possible for an
  attacker to deliberately cause a situation where:

  -  dhcpd, while running in DHCPv4 or DHCPv6 mode, or
  -  dhclient, the ISC DHCP client implementation

  will attempt to read a stored lease that contains option information
  which will trigger a bug in the option parsing code.
Comment 1 Larry the Git Cow gentoo-dev 2021-05-26 21:49:10 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=68fa06b8bd629857ef0dc03a983f6eb299cd6b69

commit 68fa06b8bd629857ef0dc03a983f6eb299cd6b69
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2021-05-26 21:48:41 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2021-05-26 21:48:53 +0000

    net-misc/dhcp: Security bump to version 4.4.2_p1
    
    Bug: https://bugs.gentoo.org/792324
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 net-misc/dhcp/Manifest             |   1 +
 net-misc/dhcp/dhcp-4.4.2_p1.ebuild | 277 +++++++++++++++++++++++++++++++++++++
 2 files changed, 278 insertions(+)
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-06-02 19:01:20 UTC
x86 done
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-06-02 19:01:30 UTC
amd64 done
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-06-02 22:41:21 UTC
arm done
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-06-03 08:22:45 UTC
ppc64 done
Comment 6 Rolf Eike Beer archtester 2021-06-03 16:56:26 UTC
sparc stable
Comment 7 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-06-03 23:38:12 UTC
arm64 done
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2021-06-07 07:35:33 UTC
ppc stable
Comment 9 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-06-08 14:07:16 UTC
All arches done, please cleanup.
Comment 10 Larry the Git Cow gentoo-dev 2021-06-08 14:10:38 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=70d1fc386a3c3e1b3af78c11aa32438ce6e6d624

commit 70d1fc386a3c3e1b3af78c11aa32438ce6e6d624
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2021-06-08 14:09:56 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2021-06-08 14:10:21 +0000

    net-misc/dhcp: Security cleanup
    
    Bug: https://bugs.gentoo.org/792324
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 net-misc/dhcp/Manifest             |   1 -
 net-misc/dhcp/dhcp-4.4.2-r3.ebuild | 277 -------------------------------------
 2 files changed, 278 deletions(-)
Comment 11 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-06-09 04:07:52 UTC
Thank you!
Comment 12 NATTkA bot gentoo-dev 2021-07-28 03:00:25 UTC
Unable to check for sanity:

> no match for package: net-misc/dhcp-4.4.2_p1
Comment 13 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-14 17:34:07 UTC
GLSA request filed
Comment 14 Larry the Git Cow gentoo-dev 2023-05-03 10:33:51 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=516446058bf5c37647ce7dfc2922a56aeaee107e

commit 516446058bf5c37647ce7dfc2922a56aeaee107e
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-05-03 10:32:25 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-05-03 10:33:45 +0000

    [ GLSA 202305-22 ] ISC DHCP: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/792324
    Bug: https://bugs.gentoo.org/875521
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202305-22.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)