7.4
HIGH
CVE-2021-25217
"ISC DHCP Dhclient/Dhcpd Stack-Based Buffer Overflow Vulnerability"
Description

In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.

INFO

Published Date :

May 26, 2021, 10:15 p.m.

Last Modified :

Nov. 21, 2024, 5:54 a.m.

Remotely Exploitable :

No

Impact Score :

4.0

Exploitability Score :

2.8
Public PoC/Exploit Available at Github

CVE-2021-25217 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2021-25217 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Siemens sinec_ins
2 Siemens ruggedcom_rox_mx5000_firmware
3 Siemens ruggedcom_rox_rx1400_firmware
4 Siemens ruggedcom_rox_rx1500_firmware
5 Siemens ruggedcom_rox_rx1501_firmware
6 Siemens ruggedcom_rox_rx1510_firmware
7 Siemens ruggedcom_rox_rx1511_firmware
8 Siemens ruggedcom_rox_rx1512_firmware
9 Siemens ruggedcom_rox_rx1524_firmware
10 Siemens ruggedcom_rox_rx1536_firmware
11 Siemens ruggedcom_rox_rx5000_firmware
12 Siemens ruggedcom_rox_mx5000
13 Siemens ruggedcom_rox_rx1400
14 Siemens ruggedcom_rox_rx1500
15 Siemens ruggedcom_rox_rx1501
16 Siemens ruggedcom_rox_rx1510
17 Siemens ruggedcom_rox_rx1511
18 Siemens ruggedcom_rox_rx1512
19 Siemens ruggedcom_rox_rx5000
20 Siemens ruggedcom_rox_rx1524
21 Siemens ruggedcom_rox_rx1536
1 Netapp ontap_select_deploy_administration_utility
2 Netapp solidfire_\&_hci_management_node
1 Fedoraproject fedora
1 Debian debian_linux
1 Isc dhcp
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2021-25217.

URL Resource
http://www.openwall.com/lists/oss-security/2021/05/26/6 Mailing List Patch Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf Patch Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf Patch Third Party Advisory
https://kb.isc.org/docs/cve-2021-25217 Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/
https://security.gentoo.org/glsa/202305-22
https://security.netapp.com/advisory/ntap-20220325-0011/ Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/26/6 Mailing List Patch Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf Patch Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf Patch Third Party Advisory
https://kb.isc.org/docs/cve-2021-25217 Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/
https://security.gentoo.org/glsa/202305-22
https://security.netapp.com/advisory/ntap-20220325-0011/ Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Updated: 2 years, 8 months ago
1 stars 0 fork 0 watcher
Born at : June 20, 2021, 9:24 p.m. This repo has been linked 13 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-25217 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2021-25217 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2021/05/26/6
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
    Added Reference https://kb.isc.org/docs/cve-2021-25217
    Added Reference https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/
    Added Reference https://security.gentoo.org/glsa/202305-22
    Added Reference https://security.netapp.com/advisory/ntap-20220325-0011/
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference Internet Systems Consortium (ISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/ [No types assigned]
    Added Reference Internet Systems Consortium (ISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/ [No types assigned]
    Removed Reference Internet Systems Consortium (ISC) https://lists.fedoraproject.org/archives/list/[email protected]/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/
    Removed Reference Internet Systems Consortium (ISC) https://lists.fedoraproject.org/archives/list/[email protected]/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/
  • CVE Modified by [email protected]

    May. 03, 2023

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/202305-22 [No Types Assigned]
  • Modified Analysis by [email protected]

    Oct. 29, 2022

    Action Type Old Value New Value
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf Patch, Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* versions up to (excluding) 1.0 *cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* *cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Sep. 13, 2022

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf [No Types Assigned]
  • Modified Analysis by [email protected]

    May. 13, 2022

    Action Type Old Value New Value
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf Patch, Third Party Advisory
    Changed Reference Type https://security.netapp.com/advisory/ntap-20220325-0011/ No Types Assigned https://security.netapp.com/advisory/ntap-20220325-0011/ Third Party Advisory
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1524:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx1536:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:* versions from (including) 2.3.0 up to (excluding) 2.15.0 OR cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Mar. 25, 2022

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20220325-0011/ [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 10, 2022

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf [No Types Assigned]
  • Initial Analysis by [email protected]

    Jun. 09, 2021

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:A/AC:L/Au:N/C:N/I:N/A:P)
    Added CVSS V3.1 NIST AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
    Changed Reference Type http://www.openwall.com/lists/oss-security/2021/05/26/6 No Types Assigned http://www.openwall.com/lists/oss-security/2021/05/26/6 Mailing List, Patch, Third Party Advisory
    Changed Reference Type https://kb.isc.org/docs/cve-2021-25217 No Types Assigned https://kb.isc.org/docs/cve-2021-25217 Exploit, Vendor Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html No Types Assigned https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html Mailing List, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/ Mailing List, Third Party Advisory
    Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/ Mailing List, Third Party Advisory
    Added CWE NIST CWE-119
    Added CPE Configuration OR *cpe:2.3:a:isc:dhcp:4.1-esv:r1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r10:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r10_b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r10_rc1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r10b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r10rc1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11_b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11_rc2:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11rc1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r11rc2:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r12:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r12-p1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r12_b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r12_p1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r12b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r13:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r13_b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r13b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r14:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r14_b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r14b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r15:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r15-p1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r15_b1:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:4.1-esv:r16:*:*:*:*:*:* *cpe:2.3:a:isc:dhcp:*:*:*:*:*:*:*:* versions from (including) 4.4.0 up to (including) 4.4.2
    Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jun. 05, 2021

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/ [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 03, 2021

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 03, 2021

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2021/05/26/6 [No Types Assigned]
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/ [No Types Assigned]
  • CVE Modified by [email protected]

    May. 26, 2021

    Action Type Old Value New Value
    Changed Description In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted. In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.34 }} 0.07%

score

0.71340

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability