CVE-2018-16228

Vulnerability

The HNCP parser in tcpdump versions before 4.9.3 contains a buffer over-read in the print_prefix() function, located in print-hncp.c [4]. The flaw occurs when decoding a malformed HNCP prefix option. Specifically, in print_prefix(), the return value of decode_prefix6() was not checked for errors; if it returned a negative value, the subsequent ND_PRINT() call would read from an uninitialized or out-of-bounds buffer [4]. The commit fixing the issue adds a check for plenbytes < 0 and returns early [4]. Affected are all tcpdump versions prior to 4.9.3.

Exploitation

An attacker needs only the ability to send a specially crafted HNCP packet over the network to a target running tcpdump that is capturing or reading the packet. No authentication is required, as tcpdump can process raw network traffic. The crafted HNCP option triggers a negative return from decode_prefix6(), causing print_prefix() to proceed with a plenbytes value of -1, leading to a buffer over-read in the subsequent ND_PRINT() call [4]. Proof-of-concept pcap files were introduced as test cases in the fix [4].

Impact

Successful exploitation results in a buffer over-read, which may leak sensitive memory contents when tcpdump prints the malformed prefix. The impact is primarily information disclosure; the over-read could leak stack or heap data from the tcpdump process's memory, potentially exposing credentials, network secrets, or other sensitive information processed by the host.

Mitigation

The vulnerability is fixed in tcpdump version 4.9.3, released on August 3, 2018 [4]. Users should upgrade to 4.9.3 or later. For users unable to upgrade, the fix commit 83a412a5275cac973c5841eca3511c766bed778d can be manually applied [4]. No workaround is available other than patching. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

References [1], [2], and [3] mention Apple security updates that addressed other vulnerabilities but do not provide specific mitigation details for CVE-2018-16228.