CVE-2018-0172

What is DHCP Option 82 on Cisco IOS/IOS XE?

DHCP option 82, the "relay agent information" option, lets a switch or router acting as a DHCP relay attach identifying data (such as the physical port a request arrived on) to a client's DHCP request before forwarding it to the DHCP server. It is widely used in enterprise and service-provider access networks to support per-port policy enforcement and to trace which physical port a given IP lease was assigned to.

Overview

CVE-2018-0172 is a high-severity denial-of-service vulnerability in the DHCP option 82 encapsulation handling of Cisco IOS and IOS XE Software. An unauthenticated, remote attacker able to send crafted DHCP packets to a device acting as a DHCP relay can trigger improper handling of the option 82 data, forcing the device into a denial-of-service condition.

Technical Details

The vulnerability is classified under CWE-20 (improper input validation): the code responsible for encapsulating and restoring option 82 data in DHCPv4 packets does not correctly validate the structure of that data in all cases, and a malformed packet can push the relay logic into an invalid state. Because DHCP relay processing happens automatically for any client request arriving on a configured interface, an attacker positioned to reach that interface (whether directly or via a spoofed request) needs no authentication to trigger the flaw.

Discovery

Cisco identified and fixed the issue internally, releasing it as part of the March 2018 semiannual IOS/IOS XE security advisory bundle alongside two closely related DHCP option 82 vulnerabilities, CVE-2018-0173 and CVE-2018-0174.

Exploitation Context

CISA's KEV catalog listing confirms real-world exploitation of this vulnerability. Denial-of-service bugs in DHCP relay functionality are attractive to attackers seeking to disrupt address assignment and network access across an entire access-layer segment, particularly in campus and branch environments where DHCP relay runs on distribution-layer switches serving many end users.

Remediation

1. Identify Cisco IOS/IOS XE devices configured as DHCP relay agents with option 82 enabled.
2. Apply the Cisco-published fixed software release from the corresponding security advisory.
3. Restrict which sources can send DHCP traffic to relay-configured interfaces using DHCP snooping and port security where supported.
4. Monitor for unexpected reloads on devices performing DHCP relay functions.
5. Review DHCP server and relay logs for malformed request patterns that could indicate exploitation attempts.