CVE-2018-16227

Vulnerability

The IEEE 802.11 parser in tcpdump versions prior to 4.9.3 contains a buffer over-read vulnerability in the print-802_11.c file, specifically when processing the Mesh Flags subfield. An attacker can trigger this by sending a specially crafted 802.11 frame that causes the parser to read beyond the allocated buffer boundaries. The issue is present in all versions before the fix was applied in 4.9.3 [2].

Exploitation

An attacker within radio range of a target system running a vulnerable version of tcpdump can exploit this vulnerability by transmitting a malicious 802.11 frame with an invalid Mesh Flags subfield. No authentication or prior access is required; the attacker only needs to be able to send wireless frames that reach the target. When tcpdump captures and parses such a frame, the over-read occurs during the parsing of the Mesh Flags field.

Impact

Successful exploitation can lead to a denial of service (crash of tcpdump) or, in some cases, information disclosure through the leakage of sensitive memory contents. The impact is limited to the tcpdump process itself; no code execution has been reported for this vulnerability.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3 [2]. Users should upgrade to this version or later. Downstream distributions, such as Fedora, have also released updated packages. No workarounds are available; the only mitigation is to apply the patch or update to the fixed version.