CVE-2022-2929: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in ISC DHCP versions 1.0 through 4.4.3 and 4.1-ESV-R1 through 4.1-ESV-R16-P1. The vulnerability allows a system with access to a DHCP server to send DHCP packets crafted with fqdn labels longer than 63 bytes, which could eventually cause the server to run out of memory (CVE Mitre, NVD).

The vulnerability exists in the DHCP server's handling of option 81 (fqdn) data received in DHCP packets. Specifically, the 'fqdnuniversedecode()' function allocates buffer space for the contents of option 81 data but fails to properly manage memory when processing fqdn labels that exceed 63 bytes (Debian LTS, Red Hat).

When exploited, this vulnerability can cause DHCP servers to continuously consume memory resources, eventually leading to a denial of service condition. The impact is particularly significant for long-running DHCP server instances (Ubuntu Security, Debian LTS).

The vulnerability has been fixed in ISC DHCP version 4.4.3-P1. System administrators are advised to upgrade their DHCP server installations to this version or apply the appropriate security patches provided by their distribution vendors (Fedora, Debian Security).