CVE-2019-8377

Vulnerability

A NULL pointer dereference was found in the get_ipv6_l4proto() function in get.c in Tcpreplay version 4.3.1 [1][2]. The function does not properly validate a pointer before dereferencing it when processing a crafted pcap file sent to the tcpreplay-edit binary with specific command-line options (e.g., -r 80:84 -s 20 -b -C -m 1500 -P --oneatatime) [1].

Exploitation

An attacker can trigger this vulnerability by supplying a specially crafted pcap file to the tcpreplay-edit tool [1]. The likely command line is tcpreplay-edit -r 80:84 -s 20 -b -C -m 1500 -P --oneatatime -i $INTERFACE $POC [1]. No authentication or special privileges are required; the attacker only needs the ability to deliver the malicious pcap to the binary.

Impact

A successful exploit causes a segmentation fault (SIGSEGV), resulting in a denial of service (crash) of the tcpreplay-edit process [1]. The description also mentions “possibly have unspecified other impact,” though no details of further compromise (e.g., code execution) have been published [1].

Mitigation

The available references do not mention a specific fixed version release date. The Tcpreplay issue tracker ([1]) and advisory ([2]) only confirm the vulnerability. As of publication, users should monitor the Tcpreplay project for a patched version. If no fix is immediately available, avoid processing untrusted pcap files with tcpreplay-edit.