Invalid characters cause assert
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.
This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-823 | CWE-823 Use of Out-of-range Pointer Offset |
Type: CWE
Description: CWE-823 Use of Out-of-range Pointer Offset
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impacts
| CAPEC ID | Description |
|---|
| N/A | A denial of service from the repeated attacks against the Kea server |
CAPEC ID: N/A
Description: A denial of service from the repeated attacks against the Kea server