CVE-2019-8376

Vulnerability

In Tcpreplay version 4.3.1, the function get_layer4_v6() in get.c contains a NULL pointer dereference vulnerability. When processing a specially crafted pcap file, the function attempts to dereference a NULL pointer, leading to a segmentation fault. The issue is triggered through the tcpreplay-edit binary [1][2].

Exploitation

An attacker must provide a malicious pcap file to the tcpreplay-edit utility (e.g., via command line invocation such as tcpreplay-edit -r 80:84 -s 20 -b -C -m 1500 -P --oneatatime -i $INTERFACE $POC). No authentication or elevated privileges are required; the attacker only needs to supply the crafted input file, which causes the crash during processing [1].

Impact

Successful exploitation results in a denial of service through a segmentation fault (NULL pointer dereference). The official description also notes the possibility of "unspecified other impact," though no further details are provided in the references [1][2].

Mitigation

As of the available references, no fixed version has been announced. Users are advised to monitor the Tcpreplay issue tracker (referenced in [1]) for updates. Fedora package announcements (references [3] and [4]) are inaccessible due to bot protection, so no specific workaround or patch information is confirmed. If no official fix is available, avoid processing untrusted pcap files with tcpreplay-edit [1].