CVE-2020-24265

An attacker provides a crafted pcap file as input to `tcpprep -a client -i [poc] -o a.cach` [ref_id=1]. When `tcpprep` processes the malformed packet, `get_l2len()` reads beyond the allocated buffer boundary, causing a heap-buffer-overflow [ref_id=1]. The overflow is a read of 3 bytes from a 2-byte heap region, leading to a crash and denial of service [ref_id=1]. No authentication or special network access is required; the attacker only needs to supply the malicious file.

The heap buffer overflow occurs in `MemcmpInterceptorCommon()` when called via `bcmp` at `get_l2len()` in `src/common/get.c:186`, which is invoked by `get_ipv4()` at `get.c:267` and ultimately by `process_raw_packets()` in `src/tcpprep.c:370` [ref_id=1]. The crash is triggered during a `READ of size 3` on a heap region that is only 2 bytes long [ref_id=1].

The advisory does not include a patch or remediation guidance [ref_id=1]. The issue was reported as a bug in tcpreplay version 4.3.3, and the expected behavior is that `tcpprep` should either produce the cache file or exit cleanly upon encountering abnormal input [ref_id=1]. Without a published fix, users must avoid processing untrusted pcap files with the affected version or apply input validation to ensure packet headers do not exceed their allocated buffer sizes.

Download tcpreplay-4.3.3.tar.gz, install libpcap-dev, configure and build. Run `tcpprep -a client -i [poc filename] -o a.cach` with the provided PoC file `poc_tcpprep_heap_buffer_overflow_MemcmpInterceptorCommon.tar.gz` [ref_id=1]. The tool will crash with an AddressSanitizer heap-buffer-overflow at `MemcmpInterceptorCommon` [ref_id=1].