ppp decapsulator can be convinced to allocate a large amount of memory

Vulnerability

The PPP decapsulator in tcpdump 4.9.3 contains a flaw where the function ppp_hdlc() allocates a buffer using the on-the-wire length (length) rather than the actual captured length (caplen). This can cause a very large allocation if a crafted packet advertises a large length value, potentially exhausting memory. The issue is fixed in commit 32027e199368dad9508965aae8cd8de5b6ab5231 on GitHub [4].

Exploitation

An attacker with the ability to inject or capture network traffic can send a specially crafted PPP packet with a large length field but truncated actual content. When tcpdump processes this packet, the ppp_hdlc() function allocates memory based on the inflated length, leading to a large allocation. No authentication or special privileges are required; the attacker only needs to send the malicious packet to a network segment monitored by a vulnerable tcpdump instance.

Impact

Successful exploitation results in denial of service due to memory exhaustion. The large allocation can cause tcpdump to crash or become unresponsive, potentially affecting network monitoring and troubleshooting. The vulnerability is limited to the specific memory allocation logic and does not allow for code execution or information disclosure.

Mitigation

Users should upgrade to a patched version of tcpdump containing commit 32027e199368dad9508965aae8cd8de5b6ab5231 [4]. Workarounds include disabling PPP capture or using packet filters to avoid processing untrusted PPP traffic. No other known mitigations are available.