A vulnerability in the ISC Kea DHCPv4 server allows remote, unauthenticated attackers to cause a process crash, leading to a denial of service.

This issue is a NULL pointer dereference occurring when the kea-dhcp4 process receives a unicast request that fails to match an appropriate subnet. The vulnerability is exploitable by unauthenticated attackers sending targeted unicast traffic, which triggers an assertion failure and terminates the service.

The successful exploitation of this vulnerability results in a denial of service for the DHCP infrastructure, which can prevent network clients from obtaining necessary configuration information. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to network availability, potentially disrupting business operations that rely on stable IP address assignment.

Immediate Action: Administrators should upgrade their ISC Kea installation to version 3.0.1 or 3.1.1 immediately to resolve this assertion failure.

Proactive Monitoring: Monitor DHCP server logs for unexpected process terminations and repeated assertion failures, particularly those originating from unicast traffic patterns.

Compensating Controls: If immediate patching is not feasible, consider restricting DHCP unicast traffic at the network perimeter to trusted sources to prevent unauthorized triggers of the vulnerable code path.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant risk to network stability due to its potential for remote exploitation without authentication. Organizations running the affected versions of ISC Kea should prioritize applying the vendor-provided patches as soon as possible to ensure the continued availability and integrity of their DHCP infrastructure.