Libpcap
Monthly
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low privileges to craft a filter program that reads or writes OS process memory beyond the intended 16-entry M[] scratch array. On 64-bit architectures the accessible range is up to 16GiB starting at the current stack frame; on 32-bit architectures the entire process address space is reachable. The Tcpdump Group has issued a fix (commit 48e8960a) that adds bounds checks before every M[] access, rejecting filters referencing register index ≥ BPF_MEMWORDS (16). No public exploit or CISA KEV listing is identified at time of analysis.
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. The root cause is an incorrect boundary check in pcap_read_nocb_remote(): the RPCAP_MSG_PACKET caplen field was validated against the full payload length rather than against the payload length minus the fixed-size RPCAP_MSG_PACKET header, creating a window of up to sizeof(struct rpcap_pkthdr) bytes that could be read beyond the buffer. No public exploit or CISA KEV listing is identified at time of analysis.
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash the service by triggering unreleased heap allocations. The daemon allocates up to 65536 bytes per RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message processed in daemon_unpackapplyfilter(), but the bf_insns BPF filter instruction array is never freed on any code path - success or error - under the pre-patch logic. A malicious rpcap client can accelerate memory exhaustion by rapidly submitting filter-update or capture-start requests. No active exploitation is confirmed and no public exploit code exists at time of analysis.
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process that evaluates a crafted BPF filter program via pcap_offline_filter(). The 'ja L' (jump always) instruction stores its target offset as a signed integer, enabling backward jumps that implement looping, but the interpreter imposed no cap on iterations, so a self-referential or backward-looping filter causes unbounded CPU consumption. The upstream fix (commit ff3c83475a) introduces a MAX_BACKWARD_JUMPS limit of 64 per packet and adds validator rejection of self-jumps; no active exploitation or public exploit code has been identified at time of analysis.
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filter program containing 'div #k' or 'mod #k' ALU instructions with k=0. The flaw, reported by The Tcpdump Group, affects all versions of libpcap (cpe:2.3:a:the_tcpdump_group:libpcap) and requires a locally-supplied malicious BPF filter - typically via an application that accepts user-controlled filter expressions and calls pcap_offline_filter(). No public exploit or active exploitation has been identified; the vendor has released a patch via GitHub commit.
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any application linked against the library by supplying a filter program containing an invalid BPF opcode. The BPF interpreter in bpf_filter.c calls abort() on encountering an unrecognized opcode - a reachable assertion (CWE-617) that converts a defensive check into a denial-of-service vector. No public exploit or active exploitation has been identified; the Tcpdump Group has released a patch replacing abort() with a safe return 0.
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter program to drive the interpreter's program counter past the end of the filter buffer, reading up to 32 GiB of surrounding process memory on 64-bit systems or the entire address space on 32-bit systems. All libpcap versions tracked under CPE cpe:2.3:a:the_tcpdump_group:libpcap are affected; The Tcpdump Group has published a fix via commit d3f358d3. No active exploitation has been confirmed and no public exploit exists; the vulnerability is restricted to uncommon application patterns that pass raw BPF bytecode directly to the interpreter without prior validation.
Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low privileges to craft a filter program that reads or writes OS process memory beyond the intended 16-entry M[] scratch array. On 64-bit architectures the accessible range is up to 16GiB starting at the current stack frame; on 32-bit architectures the entire process address space is reachable. The Tcpdump Group has issued a fix (commit 48e8960a) that adds bounds checks before every M[] access, rejecting filters referencing register index ≥ BPF_MEMWORDS (16). No public exploit or CISA KEV listing is identified at time of analysis.
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. The root cause is an incorrect boundary check in pcap_read_nocb_remote(): the RPCAP_MSG_PACKET caplen field was validated against the full payload length rather than against the payload length minus the fixed-size RPCAP_MSG_PACKET header, creating a window of up to sizeof(struct rpcap_pkthdr) bytes that could be read beyond the buffer. No public exploit or CISA KEV listing is identified at time of analysis.
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash the service by triggering unreleased heap allocations. The daemon allocates up to 65536 bytes per RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message processed in daemon_unpackapplyfilter(), but the bf_insns BPF filter instruction array is never freed on any code path - success or error - under the pre-patch logic. A malicious rpcap client can accelerate memory exhaustion by rapidly submitting filter-update or capture-start requests. No active exploitation is confirmed and no public exploit code exists at time of analysis.
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process that evaluates a crafted BPF filter program via pcap_offline_filter(). The 'ja L' (jump always) instruction stores its target offset as a signed integer, enabling backward jumps that implement looping, but the interpreter imposed no cap on iterations, so a self-referential or backward-looping filter causes unbounded CPU consumption. The upstream fix (commit ff3c83475a) introduces a MAX_BACKWARD_JUMPS limit of 64 per packet and adds validator rejection of self-jumps; no active exploitation or public exploit code has been identified at time of analysis.
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filter program containing 'div #k' or 'mod #k' ALU instructions with k=0. The flaw, reported by The Tcpdump Group, affects all versions of libpcap (cpe:2.3:a:the_tcpdump_group:libpcap) and requires a locally-supplied malicious BPF filter - typically via an application that accepts user-controlled filter expressions and calls pcap_offline_filter(). No public exploit or active exploitation has been identified; the vendor has released a patch via GitHub commit.
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any application linked against the library by supplying a filter program containing an invalid BPF opcode. The BPF interpreter in bpf_filter.c calls abort() on encountering an unrecognized opcode - a reachable assertion (CWE-617) that converts a defensive check into a denial-of-service vector. No public exploit or active exploitation has been identified; the Tcpdump Group has released a patch replacing abort() with a safe return 0.
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter program to drive the interpreter's program counter past the end of the filter buffer, reading up to 32 GiB of surrounding process memory on 64-bit systems or the entire address space on 32-bit systems. All libpcap versions tracked under CPE cpe:2.3:a:the_tcpdump_group:libpcap are affected; The Tcpdump Group has published a fix via commit d3f358d3. No active exploitation has been confirmed and no public exploit exists; the vulnerability is restricted to uncommon application patterns that pass raw BPF bytecode directly to the interpreter without prior validation.
Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.