# CVE-2019-6470: dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries > A use-after-free error in ISC DHCP server causes a crash in IPv6 mode when using mismatched BIND libraries, leading to denial of service. - **Severity:** Medium 6.5 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 1 Nov 2019 - **Updated:** 17 Sep 2024 - **Also known as:** ALPINE-CVE-2019-6470, AZL-34558, AZL-6326, DEBIAN-CVE-2019-6470, GHSA-w4w8-43xj-r4wr, RHSA-2019:2060, RHSA-2019:3525, SUSE-SU-2019:2657-1, SUSE-SU-2019:2727-1, SUSE-SU-2019:2727-2, UBUNTU-CVE-2019-6470, USN-3973-1, openSUSE-SU-2019:2340-1, openSUSE-SU-2019:2341-1 ## What is CVE-2019-6470? CVE-2019-6470 is a medium-severity use after free vulnerability in Opensuse Leap, published on 1 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation. ## Which versions are affected by CVE-2019-6470? It affects 19 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `dhclient` | Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-77.el7 | | `dhcp` | Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-77.el7 | | `dhcp-common` | Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-77.el7 | | `dhcp-debuginfo` | Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-77.el7 | | `dhcp-devel` | Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-77.el7 | | `dhcp-libs` | Red Hat:enterprise_linux:7::client | All versions | 12:4.2.5-77.el7 | | `dhclient` | Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-77.el7 | | `dhcp` | Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-77.el7 | | `dhcp-common` | Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-77.el7 | | `dhcp-debuginfo` | Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-77.el7 | | `dhcp-devel` | Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-77.el7 | | `dhcp-libs` | Red Hat:enterprise_linux:7::computenode | All versions | 12:4.2.5-77.el7 | | `dhclient` | Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-77.el7 | | `dhcp` | Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-77.el7 | | `dhcp-common` | Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-77.el7 | | `dhcp-debuginfo` | Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-77.el7 | | `dhcp-devel` | Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-77.el7 | | `dhcp-libs` | Red Hat:enterprise_linux:7::server | All versions | 12:4.2.5-77.el7 | | `dhclient` | Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-77.el7 | | `dhcp` | Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-77.el7 | | `dhcp-common` | Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-77.el7 | | `dhcp-debuginfo` | Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-77.el7 | | `dhcp-devel` | Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-77.el7 | | `dhcp-libs` | Red Hat:enterprise_linux:7::workstation | All versions | 12:4.2.5-77.el7 | | `dhcp` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-client` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-client-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-common` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-debugsource` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-libs` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-libs-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-relay` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-relay-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-server` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp-server-debuginfo` | Red Hat:enterprise_linux:8::baseos | All versions | 12:4.3.6-34.el8 | | `dhcp` | SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 4.3.3-10.19.1 | | `dhcp` | SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 4.3.5-6.3.1 | | `dhcp` | SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 4.3.5-6.3.1 | | `dhcp` | SUSE:Linux Enterprise Module for Server Applications 15 | All versions | 4.3.5-6.3.1 | Products: Isc Dhcpd, Opensuse Leap, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Arm 64 Eus, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Ibm Z Systems Eus, Redhat Enterprise Linux for Power Big Endian, Redhat Enterprise Linux for Power Little Endian, Redhat Enterprise Linux for Power Little Endian Eus, Redhat Enterprise Linux for Scientific Computing, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server for Power Little Endian Update Services for Sap Solutions, Redhat Enterprise Linux Server Tus, Redhat Enterprise Linux Update Services for Sap Solutions, Redhat Enterprise Linux Workstation. ## How do I fix CVE-2019-6470? Upgrade to a fixed version. ## Is CVE-2019-6470 being exploited? There is no known exploitation of CVE-2019-6470 in the wild and no public exploit code. ## Other vulnerabilities in Opensuse Leap - [CVE-2004-1006](https://insights.sbomify.com/CVE-2004-1006/): Code injection in n/a (critical 10.0) - [CVE-2002-0702](https://insights.sbomify.com/CVE-2002-0702/): Code injection in n/a (critical 10.0) - [CVE-2003-0026](https://insights.sbomify.com/CVE-2003-0026/): Memory corruption in n/a (high 7.5) - [CVE-2006-3122](https://insights.sbomify.com/CVE-2006-3122/): Denial of service in n/a (medium 5.0) - [CVE-2003-0039](https://insights.sbomify.com/CVE-2003-0039/): Denial of service in n/a (medium 5.0) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2019-6470 and fix it if it is affected. What it is: CVE-2019-6470 is a medium-severity use after free vulnerability in Opensuse Leap, published on 1 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2019-6470 in the wild and no public exploit code. Affected product: Opensuse Leap. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2019-6470/ (Markdown: https://insights.sbomify.com/CVE-2019-6470/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2019-6470 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-6470 - OSV: https://osv.dev/vulnerability/CVE-2019-6470 --- From sbomify Insights: https://insights.sbomify.com/CVE-2019-6470/ Summaries are generated and may contain mistakes; the official description above is the record.