tcpdump libpcap up to 1.9.x/1.10.4 pcap_findalldevs_ex null pointer dereference

Summaryinfo

A vulnerability was found in tcpdump libpcap up to 1.9.x/1.10.4. It has been classified as problematic. Affected is the function pcap_findalldevs_ex. This manipulation causes null pointer dereference. This vulnerability appears as CVE-2024-8006. The attack requires local access. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in tcpdump libpcap up to 1.9.x/1.10.4. It has been declared as problematic. Affected by this vulnerability is the function pcap_findalldevs_ex. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.

The weakness was presented by Flavio Toffalini as 0f8a103469ce87d2b8d68c5130a46ddb7fb5eb29. The advisory is shared at github.com. This vulnerability is known as CVE-2024-8006 since 08/20/2024. The exploitation appears to be easy. An attack has to be approached locally. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 210130 (CBL Mariner 2.0 Security Update: libpcap (CVE-2024-8006)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 0f8a103469ce87d2b8d68c5130a46ddb7fb5eb29 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (210130). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Packet Analyzer Software

Vendor

• tcpdump

Name

• libpcap

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion