tcpdump libpcap up to 1.8.x/1.9.x/1.10.4 sock_initaddress double free

Summaryinfo

A vulnerability was found in tcpdump libpcap up to 1.8.x/1.9.x/1.10.4. It has been declared as problematic. This affects the function sock_initaddress. The manipulation results in double free. This vulnerability is known as CVE-2023-7256. Attacking locally is a requirement. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in tcpdump libpcap up to 1.8.x/1.9.x/1.10.4. Affected is the function sock_initaddress. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on availability. CVE summarizes:

In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-7256 since 04/11/2024. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 211708 (CBL Mariner 2.0 Security Update: libpcap / nmap (CVE-2023-7256)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 262e4f34979872d822ccedf9f318ed89c4d31c03 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (211708). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Packet Analyzer Software

Vendor

• tcpdump

Name

• libpcap

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion