CVE-2021-25217
📋 TL;DR
A memory corruption vulnerability in ISC DHCP allows attackers to cause denial of service by crashing dhclient or dhcpd processes when they parse malicious lease files. The vulnerability affects DHCP servers and clients running vulnerable versions, potentially disrupting network connectivity. Impact varies based on architecture (32-bit vs 64-bit) and compiler flags used during build.
💻 Affected Systems
- ISC DHCP
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Ontap Select Deploy Administration Utility by Netapp
View all CVEs affecting Ontap Select Deploy Administration Utility →
Sinec Ins by Siemens
Sinec Ins by Siemens
Sinec Ins by Siemens
⚠️ Risk & Real-World Impact
Worst Case
DHCP server crashes and deletes legitimate leases, causing widespread network connectivity loss for all clients relying on DHCP services.
Likely Case
DHCP client crashes on affected 32-bit systems, causing individual systems to lose network connectivity until DHCP client restarts.
If Mitigated
With proper patching, no impact beyond normal DHCP operations.
🎯 Exploit Status
Exploitation requires ability to inject or manipulate lease files, which typically requires some level of access to the DHCP server or client system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ISC DHCP 4.1-ESV-R17, ISC DHCP 4.4.3
Vendor Advisory: https://kb.isc.org/docs/cve-2021-25217
Restart Required: Yes
Instructions:
1. Download patched version from ISC website. 2. Stop DHCP service. 3. Backup configuration and lease files. 4. Install updated package. 5. Restart DHCP service.
🔧 Temporary Workarounds
Restrict lease file access
linuxLimit write access to DHCP lease files to prevent malicious lease injection
chmod 640 /var/lib/dhcp/dhcpd.leases
chown root:dhcpd /var/lib/dhcp/dhcpd.leases
Monitor lease file integrity
linuxImplement file integrity monitoring on DHCP lease files
# Use tools like AIDE, Tripwire, or auditd to monitor lease file changes
🧯 If You Can't Patch
- Implement strict access controls on DHCP lease files to prevent unauthorized modifications
- Monitor DHCP service health and implement automatic restart mechanisms for crashes
🔍 How to Verify
Check if Vulnerable:
Check ISC DHCP version: dhcpd --version 2>&1 | head -1Check Version:
dhcpd --version 2>&1 | grep -oE '4\.[0-9]+\.[0-9]+' || dhclient --version 2>&1 | grep -oE '4\.[0-9]+\.[0-9]+'Verify Fix Applied:
Verify version is 4.1-ESV-R17 or higher, or 4.4.3 or higher📡 Detection & Monitoring
Log Indicators:
- DHCP service crashes
- Unexpected lease deletions
- Error messages about lease parsing
Network Indicators:
- Clients failing to obtain/renew IP addresses
- Increased DHCP discovery/request traffic
SIEM Query:
source="dhcpd.log" AND ("crash" OR "segmentation fault" OR "aborted" OR "unexpected lease")🔗 References
- http://www.openwall.com/lists/oss-security/2021/05/26/6
- https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- https://kb.isc.org/docs/cve-2021-25217
- https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/
- https://security.gentoo.org/glsa/202305-22
- https://security.netapp.com/advisory/ntap-20220325-0011/
- http://www.openwall.com/lists/oss-security/2021/05/26/6
- https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- https://kb.isc.org/docs/cve-2021-25217
- https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/
- https://security.gentoo.org/glsa/202305-22
- https://security.netapp.com/advisory/ntap-20220325-0011/
