CVE-2015-6242 in Wireshark
Summary
by MITRE
The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size, which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/13/2022
The vulnerability identified as CVE-2015-6242 resides within the wmem block allocator implementation in Wireshark's memory management subsystem. This flaw specifically affects Wireshark versions 1.12.x prior to 1.12.7, where the wmem_block_split_free_chunk function fails to properly handle a particular scenario involving multiple realloc operations that return a memory chunk to its original size. The issue stems from improper memory management logic that does not account for the complex state transitions that occur during such operations.
The technical root cause of this vulnerability lies in the memory allocator's inability to correctly track memory chunk states when multiple reallocation operations occur in sequence. When a memory chunk undergoes several realloc operations that ultimately restore it to its original dimensions, the allocator's internal bookkeeping becomes inconsistent. This inconsistency leads to incorrect free operations being performed on memory chunks, which can result in double-free conditions or other memory corruption scenarios. The flaw manifests when Wireshark processes a crafted packet that triggers this specific sequence of memory operations within the wmem allocator.
From an operational perspective, this vulnerability presents a significant denial of service risk to Wireshark users. Remote attackers can exploit this weakness by crafting specially designed network packets that, when processed by the affected Wireshark versions, will cause the application to crash. The crash occurs due to the incorrect free operations that corrupt the allocator's internal structures, leading to application instability and complete service disruption. This makes the vulnerability particularly dangerous in network monitoring and analysis environments where Wireshark is deployed to process untrusted network traffic.
The vulnerability aligns with CWE-415, which describes improper handling of memory allocation and deallocation operations that can lead to double-free conditions. Additionally, it relates to ATT&CK technique T1499.001, which covers network denial of service attacks through resource exhaustion or corruption. The flaw demonstrates how memory management errors in network analysis tools can be exploited to compromise system availability. Organizations using affected Wireshark versions should prioritize immediate patching to address this vulnerability. The fix implemented in Wireshark 1.12.7 properly handles the edge case of multiple realloc operations that restore chunks to their original size, ensuring that the allocator maintains consistent internal state throughout all memory management operations. This vulnerability underscores the critical importance of robust memory management in network security tools where untrusted input processing is a core function.