CVE-2018-0174

What is DHCP Option 82 on Cisco IOS/IOS XE?

DHCP option 82 (relay agent information) lets a switch or router acting as a DHCP relay tag client requests with identifying data such as the ingress port before forwarding them to the DHCP server, supporting per-port access policy and lease tracing in enterprise access networks.

Overview

CVE-2018-0174 is a high-severity denial-of-service vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS and IOS XE Software. It is the third of three closely related option 82 vulnerabilities disclosed together in March 2018 (alongside CVE-2018-0172 and CVE-2018-0173), each affecting a distinct code path involved in encapsulating or restoring option 82 data. An unauthenticated, remote attacker able to send crafted DHCP packets to an affected relay device can trigger the flaw and cause a denial-of-service condition.

Technical Details

The vulnerability is classified under CWE-20 (improper input validation). As with its companion CVEs, insufficiently validated option 82 data processed during DHCP relay operations can drive the device into an unstable state. No authentication is required — an attacker need only be able to deliver crafted DHCP traffic to an interface where the affected relay processing occurs.

Discovery

Cisco identified and fixed the issue internally as part of the March 2018 semiannual IOS/IOS XE security advisory bundle.

Exploitation Context

CISA's KEV catalog listing confirms this vulnerability has been exploited in real-world attacks. Because it shares a root cause category and disclosure timing with CVE-2018-0172 and CVE-2018-0173, organizations that were exposed to one of the three were typically exposed to all three, and exploitation activity affecting DHCP relay infrastructure in this era should be assumed to potentially involve any of the three CVEs.

Remediation

1. Identify Cisco IOS/IOS XE devices configured as DHCP relay agents with option 82 enabled.
2. Apply the Cisco-published fixed software release, which addresses all three related option 82 vulnerabilities in the same train.
3. Use DHCP snooping and port security to limit which sources can send DHCP traffic through relay-configured interfaces.
4. Monitor affected devices for unexpected reloads tied to DHCP relay processing.
5. Treat patching of CVE-2018-0172, CVE-2018-0173, and CVE-2018-0174 as a single remediation action given their shared fix.