VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 3, 2019· Updated Aug 5, 2024

CVE-2018-14466

CVE-2018-14466

Description

Buffer over-read in tcpdump's Rx parser before 4.9.3 may lead to denial of service or code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer over-read in tcpdump's Rx parser before 4.9.3 may lead to denial of service or code execution.

Vulnerability

The Rx parser in tcpdump before version 4.9.3 contains a buffer over-read vulnerability in the functions rx_cache_find() and rx_cache_insert() in print-rx.c. This can be triggered when processing crafted network packets [4].

Exploitation

An attacker can send a specially crafted packet to a target system running a vulnerable tcpdump version. No authentication is required; the attacker only needs network access to trigger the vulnerability when tcpdump captures or processes the malicious packet. The over-read occurs in the Rx cache handling code.

Impact

Successful exploitation may lead to a denial of service (crash) or potentially arbitrary code execution, depending on the environment. The attacker may cause tcpdump to read beyond the bounds of allocated memory.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3 [4]. Ubuntu has released updated packages for 12.04 ESM, 14.04 ESM, 18.04 LTS, and others [2][3]. Users should upgrade to the latest version.

References
  1. USN-4252-2: tcpdump vulnerabilities | Ubuntu security notices | Ubuntu
  2. USN-4252-1: tcpdump vulnerabilities | Ubuntu security notices | Ubuntu
  3. tcpdump/CHANGES at tcpdump-4.9 · the-tcpdump-group/tcpdump

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

11

Patches

2
d9a693b04326

VERSION set for release

https://github.com/the-tcpdump-group/tcpdumpMichael RichardsonSep 30, 2019via osv
commit
1 file changed · +1 −1
  • VERSION+1 −1 modified
    @@ -1 +1 @@
-4.9.3rc2
+4.9.3
c24922e692a5

(for 4.9.3) CVE-2018-14466/Rx: fix an over-read bug

https://github.com/the-tcpdump-group/tcpdumpDenis OvsienkoSep 19, 2017via osv
commit
4 files changed · +6 −2
  • print-rx.c+2 −2 modified
    @@ -694,7 +694,7 @@ rx_cache_insert(netdissect_options *ndo,
 	UNALIGNED_MEMCPY(&rxent->client, &ip->ip_src, sizeof(uint32_t));
 	UNALIGNED_MEMCPY(&rxent->server, &ip->ip_dst, sizeof(uint32_t));
 	rxent->dport = dport;
-	rxent->serviceId = EXTRACT_32BITS(&rxh->serviceId);
+	rxent->serviceId = EXTRACT_16BITS(&rxh->serviceId);
 	rxent->opcode = EXTRACT_32BITS(bp + sizeof(struct rx_header));
 }
 
@@ -725,7 +725,7 @@ rx_cache_find(const struct rx_header *rxh, const struct ip *ip, int sport,
 		if (rxent->callnum == EXTRACT_32BITS(&rxh->callNumber) &&
 		    rxent->client.s_addr == clip &&
 		    rxent->server.s_addr == sip &&
-		    rxent->serviceId == EXTRACT_32BITS(&rxh->serviceId) &&
+		    rxent->serviceId == EXTRACT_16BITS(&rxh->serviceId) &&
 		    rxent->dport == sport) {
 
 			/* We got a match! */
  • tests/rx_serviceid_oobr.out+3 −0 added
    @@ -0,0 +1,3 @@
+IP 250.15.128.19.68 > 249.251.157.8.63246: BOOTP/DHCP, unknown (0x00), length 8085
+[|ether]
+IP 0.0.0.0.0 > 0.0.0.0.7004:  rx abort (539)
  • tests/rx_serviceid_oobr.pcap+0 −0 added
  • tests/TESTLIST+1 −0 modified
    @@ -573,6 +573,7 @@ ikev1_id_ipv6_addr_subnet-oobr	ikev1_id_ipv6_addr_subnet-oobr.pcap	ikev1_id_ipv6
 isakmp-various-oobr	isakmp-various-oobr.pcap	isakmp-various-oobr.out	-v
 aoe-oobr-1		aoe-oobr-1.pcap			aoe-oobr-1.out	-v -c1
 frf16_magic_ie-oobr	frf16_magic_ie-oobr.pcap	frf16_magic_ie-oobr.out	-v -c1
+rx_serviceid_oobr	rx_serviceid_oobr.pcap		rx_serviceid_oobr.out -c3
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.