Skip to content
Fencer Vulns
high 7.4

CVE-2021-25217 json

A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient

published 2021-05-26 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12128

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
6.1%
EPSS 6.1% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.

Patch / fix

  • ISC ISC DHCP 4.1-ESV-R16-P1, 4.4.2-P1
  • isc-dhcp Debian 13, Debian 12 4.4.1-2.3

debian advisories DEBIAN-CVE-2021-25217

  • isc-dhcp Ubuntu 18.04 LTS 4.3.5-3ubuntu7.3
  • isc-dhcp Ubuntu 20.04 LTS 4.4.1-2.1ubuntu5.20.04.2
  • isc-dhcp Ubuntu Pro 14.04 LTS 4.2.4-7ubuntu12.13+esm1
  • isc-dhcp Ubuntu Pro 16.04 LTS 4.3.3-5ubuntu12.10+esm1

ubuntu advisories UBUNTU-CVE-2021-25217

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dhcp openshift 4.7 12:4.3.6-41.el8_3.1
  • cri-o openshift 4.7 1.20.3-6.rhaos4.7.git0d0f863.el7
  • cri-o openshift 4.7 1.20.3-6.rhaos4.7.git0d0f863.el8
  • polkit openshift 4.7 0.115-11.el8_3.2
  • dhcp-libs openshift 4.7 12:4.3.6-41.el8_3.1
  • dhcp-client openshift 4.7 12:4.3.6-41.el8_3.1
  • dhcp-common openshift 4.7 12:4.3.6-41.el8_3.1
  • polkit-libs openshift 4.7 0.115-11.el8_3.2

red hat advisories RHSA-2021:2555RHSA-2021:2419RHSA-2021:2414RHSA-2021:2420RHSA-2021:2357RHSA-2021:2416

  • dhcp SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +14 more 4.3.6.P1-6.11.1
  • dhcp SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 4.3.3-10.22.1
  • dhcp SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 4.2.4.P2-0.28.12.1

suse advisories SUSE-SU-2021:1841-1SUSE-SU-2021:1822-1SUSE-SU-2021:14740-1

  • dhcp openSUSE Tumbleweed 4.4.2.P1-2.4
  • dhcp openSUSE Leap 15.3 4.3.6.P1-6.11.1
  • dhcp openSUSE Leap 15.2 4.3.6.P1-lp152.8.6.1

opensuse advisories openSUSE-SU-2024:10715-1openSUSE-SU-2021:1841-1openSUSE-SU-2021:0834-1

  • dhcp Rocky Linux 8 2:4.3.6-44.el8_4.1

rocky linux advisories RLSA-2021:2359

  • dhcp Alpine 3.20, Alpine 3.19, Alpine 3.18 +6 more 4.4.2_p1-r0

alpine advisories ALPINE-CVE-2021-25217

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dhcp CBL-Mariner 2.0 4.4.2-4

azure linux advisories AZL-6372

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • dhclient Arch Linux 4.4.2.P1-1
  • dhcp Arch Linux 4.4.2.P1-1

arch linux advisories AVG-2004

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-25217 updated cvss 8.8

dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient

  • Red Hat Enterprise Linux BaseOS (v. 8) dhcp 4.3.6-44.el8_4.1, dhcp-libs 4.3.6-44.el8_4.1, dhcp-relay 4.3.6-44.el8_4.1, dhcp-client 4.3.6-44.el8_4.1, dhcp-common 4.3.6-44.el8_4.1, dhcp-server 4.3.6-44.el8_4.1
    fixed: vendor fix RHSA-2021:2359
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) dhcp 4.3.6-34.el8_1.2, dhcp-libs 4.3.6-34.el8_1.2, dhcp-relay 4.3.6-34.el8_1.2, dhcp-client 4.3.6-34.el8_1.2, dhcp-common 4.3.6-34.el8_1.2, dhcp-server 4.3.6-34.el8_1.2
    fixed: vendor fix RHSA-2021:2416
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) dhcp 4.3.6-40.el8_2.2, dhcp-libs 4.3.6-40.el8_2.2, dhcp-relay 4.3.6-40.el8_2.2, dhcp-client 4.3.6-40.el8_2.2, dhcp-common 4.3.6-40.el8_2.2, dhcp-server 4.3.6-40.el8_2.2
    fixed: vendor fix RHSA-2021:2420
  • Red Hat Enterprise Linux Client (v. 7) dhcp 4.2.5-83.el7_9.1, dhclient 4.2.5-83.el7_9.1, dhcp-libs 4.2.5-83.el7_9.1, dhcp-common 4.2.5-83.el7_9.1 Red Hat Enterprise Linux Client Optional (v. 7) dhcp 4.2.5-83.el7_9.1
    fixed: vendor fix RHSA-2021:2357
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) dhcp 4.2.5-77.el7_7.1, dhclient 4.2.5-77.el7_7.1, dhcp-libs 4.2.5-77.el7_7.1, dhcp-common 4.2.5-77.el7_7.1
    fixed: vendor fix RHSA-2021:2405
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) dhcp 4.2.5-83.el7_9.1
    fixed: vendor fix RHSA-2021:2357
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) dhcp 4.2.5-77.el7_7.1
    fixed: vendor fix RHSA-2021:2405
  • Red Hat Enterprise Linux Server (v. 6 ELS) dhcp 4.1.1-64.P1.el6_10, dhclient 4.1.1-64.P1.el6_10, dhcp-common 4.1.1-64.P1.el6_10
    fixed: vendor fix RHSA-2021:2419
show 25 more
  • Red Hat Enterprise Linux Server (v. 7) dhcp 4.2.5-83.el7_9.1, dhclient 4.2.5-83.el7_9.1, dhcp-libs 4.2.5-83.el7_9.1, dhcp-common 4.2.5-83.el7_9.1
    fixed: vendor fix RHSA-2021:2357
  • Red Hat Enterprise Linux Server AUS (v. 7.2) dhcp 4.2.5-42.el7_2.2, dhclient 4.2.5-42.el7_2.2, dhcp-libs 4.2.5-42.el7_2.2, dhcp-common 4.2.5-42.el7_2.2
    fixed: vendor fix RHSA-2021:2418
  • Red Hat Enterprise Linux Server AUS (v. 7.3) dhcp 4.2.5-47.el7_3.2, dhclient 4.2.5-47.el7_3.2, dhcp-libs 4.2.5-47.el7_3.2, dhcp-common 4.2.5-47.el7_3.2
    fixed: vendor fix RHSA-2021:2415
  • Red Hat Enterprise Linux Server AUS (v. 7.4) dhcp 4.2.5-58.el7_4.5, dhclient 4.2.5-58.el7_4.5, dhcp-libs 4.2.5-58.el7_4.5, dhcp-common 4.2.5-58.el7_4.5
    fixed: vendor fix RHSA-2021:2414
  • Red Hat Enterprise Linux Server AUS (v. 7.6) dhcp 4.2.5-69.el7_6.1, dhclient 4.2.5-69.el7_6.1, dhcp-libs 4.2.5-69.el7_6.1, dhcp-common 4.2.5-69.el7_6.1
    fixed: vendor fix RHSA-2021:2469
  • Red Hat Enterprise Linux Server E4S (v. 7.4) dhcp 4.2.5-58.el7_4.5, dhclient 4.2.5-58.el7_4.5, dhcp-libs 4.2.5-58.el7_4.5, dhcp-common 4.2.5-58.el7_4.5
    fixed: vendor fix RHSA-2021:2414
  • Red Hat Enterprise Linux Server E4S (v. 7.6) dhcp 4.2.5-69.el7_6.1, dhclient 4.2.5-69.el7_6.1, dhcp-libs 4.2.5-69.el7_6.1, dhcp-common 4.2.5-69.el7_6.1
    fixed: vendor fix RHSA-2021:2469
  • Red Hat Enterprise Linux Server EUS (v. 7.7) dhcp 4.2.5-77.el7_7.1, dhclient 4.2.5-77.el7_7.1, dhcp-libs 4.2.5-77.el7_7.1, dhcp-common 4.2.5-77.el7_7.1
    fixed: vendor fix RHSA-2021:2405
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) dhcp-devel 4.1.1-64.P1.el6_10, dhcp-debuginfo 4.1.1-64.P1.el6_10
    fixed: vendor fix RHSA-2021:2419
  • Red Hat Enterprise Linux Server Optional (v. 7) dhcp-devel 4.2.5-83.el7_9.1, dhcp-debuginfo 4.2.5-83.el7_9.1
    fixed: vendor fix RHSA-2021:2357
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.2) dhcp-devel 4.2.5-42.el7_2.2, dhcp-debuginfo 4.2.5-42.el7_2.2
    fixed: vendor fix RHSA-2021:2418
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) dhcp-devel 4.2.5-47.el7_3.2, dhcp-debuginfo 4.2.5-47.el7_3.2
    fixed: vendor fix RHSA-2021:2415
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) dhcp-devel 4.2.5-58.el7_4.5, dhcp-debuginfo 4.2.5-58.el7_4.5
    fixed: vendor fix RHSA-2021:2414
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.6) dhcp-devel 4.2.5-69.el7_6.1, dhcp-debuginfo 4.2.5-69.el7_6.1
    fixed: vendor fix RHSA-2021:2469
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.4) dhcp-devel 4.2.5-58.el7_4.5, dhcp-debuginfo 4.2.5-58.el7_4.5
    fixed: vendor fix RHSA-2021:2414
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.6) dhcp-devel 4.2.5-69.el7_6.1, dhcp-debuginfo 4.2.5-69.el7_6.1
    fixed: vendor fix RHSA-2021:2469
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) dhcp-devel 4.2.5-77.el7_7.1, dhcp-debuginfo 4.2.5-77.el7_7.1
    fixed: vendor fix RHSA-2021:2405
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.4) dhcp-devel 4.2.5-58.el7_4.5, dhcp-debuginfo 4.2.5-58.el7_4.5
    fixed: vendor fix RHSA-2021:2414
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.6) dhcp-devel 4.2.5-69.el7_6.1, dhcp-debuginfo 4.2.5-69.el7_6.1
    fixed: vendor fix RHSA-2021:2469
  • Red Hat Enterprise Linux Server TUS (v. 7.4) dhcp 4.2.5-58.el7_4.5, dhclient 4.2.5-58.el7_4.5, dhcp-libs 4.2.5-58.el7_4.5, dhcp-common 4.2.5-58.el7_4.5
    fixed: vendor fix RHSA-2021:2414
  • Red Hat Enterprise Linux Server TUS (v. 7.6) dhcp 4.2.5-69.el7_6.1, dhclient 4.2.5-69.el7_6.1, dhcp-libs 4.2.5-69.el7_6.1, dhcp-common 4.2.5-69.el7_6.1
    fixed: vendor fix RHSA-2021:2469
  • Red Hat Enterprise Linux Workstation (v. 7) dhcp 4.2.5-83.el7_9.1, dhclient 4.2.5-83.el7_9.1, dhcp-libs 4.2.5-83.el7_9.1, dhcp-common 4.2.5-83.el7_9.1 Red Hat Enterprise Linux Workstation Optional (v. 7) dhcp-devel 4.2.5-83.el7_9.1, dhcp-debuginfo 4.2.5-83.el7_9.1
    fixed: vendor fix RHSA-2021:2357
  • Red Hat OpenShift Container Platform 4.7 dhcp 4.3.6-41.el8_3.1, polkit 0.115-11.el8_3.2, dhcp-libs 4.3.6-41.el8_3.1, dhcp-client 4.3.6-41.el8_3.1, dhcp-common 4.3.6-41.el8_3.1, polkit-libs 0.115-11.el8_3.2, +11 more
    fixed: vendor fix RHSA-2021:2555
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.16-20210615.0.el7_9, redhat-virtualization-host-image-update 4.3.16-20210615.0.el7_9 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.16-20210615.0.el7_9, redhat-virtualization-host-image-update 4.3.16-20210615.0.el7_9
    fixed: vendor fix RHSA-2021:2519
  • Red Hat Enterprise Linux 9 dhcp, dhcp-relay, dhcp-client, dhcp-common, dhcp-server Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.16-1.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.16-1.el7ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.12% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • kb.isc.org https://kb.isc.org/docs/cve-2021-25217 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 3.3 AV:A/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • ISC ISC DHCP

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.