AI analysis
libpcap's userspace BPF interpreter fails to detect two malformed conditions in a loaded filter program: execution reaching the end of the filter buffer without a return instruction, and a jump instruction whose offset resolves to a pointer outside the buffer. If such a crafted filter program is executed — which the maintainer notes happens only in uncommon use cases, since filters normally run in the kernel — the interpreter reads process memory far beyond the buffer, sweeping up to 32 GiB around it on 64-bit systems or the entire address space on 32-bit systems. The consequence is a crash of the capturing process (a local denial of service): the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, availability-only) confirms a low-privilege local availability issue with no confidentiality or integrity impact. Potentially affected are applications that link libpcap and apply user-supplied filter programs through its interpreter, most prominently tcpdump and other packet-capture and monitoring tools built on the library. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only a 0.1% chance of exploitation within 30 days.
What to do: Upgrade to libpcap 1.10.7 — per the maintainer this release fixes this flaw along with six other vulnerabilities — and rebuild or update dependent packages such as tcpdump against the updated library. Until then, restrict which local users can attach crafted BPF filters to processes running libpcap's interpreter path. Given the local attack vector, ~0.1% EPSS, and no known public PoC, treat this as routine patching rather than an emergency.
Affected
| tcpdump.org libpcap | Releases prior to 1.10.7 (fixed in libpcap 1.10.7, which addresses this and six other vulnerabilities) |
Estimated exposure
masshundreds of millions of installations (libpcap ships in virtually all Linux/BSD distributions via tcpdump and other capture tools), though only uncommon… — libpcap is a foundational packet-capture library pulled in as a dependency of tcpdump and bundled by essentially every major Linux and BSD distribution, so the installed base is far above the 1M 'mass' threshold; the vulnerable code path…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.