VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 16, 2023· Updated Feb 26, 2025

CVE-2023-27783

CVE-2023-27783

Description

An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An assertion failure in TCPreplay tcprewrite v4.4.3's tcpedit_dlt_cleanup() function allows a remote attacker to cause a denial of service via a crafted pcap file.

Vulnerability

An issue found in TCPreplay tcprewrite v4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c. The bug is triggered when tcprewrite processes a crafted pcap file in DLT_JUNIPER_ETHER mode, where the dlt_jnpr_ether_cleanup callback passes a NULL context pointer (ctx=0x0) to tcpedit_dlt_cleanup, which then hits a reachable assertion (assert(ctx)) on line 462 [1][2].

Exploitation

An attacker needs no authentication; only the ability to supply a crafted pcap file to the target system running tcprewrite. The steps are: (1) create a malformed pcap file that causes DLT_JUNIPER_ETHER context to be set up in a way that leaves the plugin context pointer NULL, (2) induce the victim to run tcprewrite --dlt="jnpr_eth" -i -o /dev/null. The program then crashes due to the assertion failure [1][2].

Impact

A successful exploit causes the tcprewrite process to abort, resulting in a denial of service. No code execution or elevation of privilege is reported; the impact is limited to availability [1][2].

Mitigation

The fix is provided in GitHub pull request #781 (merged after the advisory) [1]. The corrected code adds a NULL check for the sub-context pointer before calling tcpedit_dlt_cleanup in the dlt_jnpr_ether_cleanup function. Users should update to a patched version of TCPreplay (post-v4.4.3). No workaround is documented; developers have addressed the root cause by patching the plugin cleanup logic [1][2].

References
  1. dlt_jnpr_ether_cleanup: check subctx before cleanup by Marsman1996 · Pull Request #781 · appneta/tcpreplay
  2. [Bug] Reachable assertion in tcpedit_dlt_cleanup() at plugins/dlt_plugins.c

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

6

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing NULL pointer check in dlt_jnpr_ether_cleanup before calling tcpedit_dlt_cleanup with a sub-context that may be NULL."

Attack vector

An attacker crafts a pcap file with DLT_JUNIPER_ETHER data link type that triggers a code path where the sub-context pointer passed to tcpedit_dlt_cleanup is NULL [ref_id=2]. The attacker supplies this file as input to tcprewrite with the --dlt="jnpr_eth" flag [ref_id=2]. When tcprewrite processes the file, the call chain reaches dlt_jnpr_ether_cleanup at plugins/dlt_jnpr_ether/jnpr_ether.c:171, which calls tcpedit_dlt_cleanup with a NULL ctx argument [ref_id=2]. The assertion at plugins/dlt_plugins.c:462 (`Assertion 'ctx' failed`) terminates the program, causing a denial of service [ref_id=2].

Affected code

The vulnerable code is in plugins/dlt_jnpr_ether/jnpr_ether.c at the dlt_jnpr_ether_cleanup function (line 171) [ref_id=2]. This function calls tcpedit_dlt_cleanup in plugins/dlt_plugins.c (line 462) without first checking whether the sub-context pointer is NULL [ref_id=2]. The fix is in pull request #781 which adds a NULL check before the cleanup call [ref_id=1].

What the fix does

The fix in pull request #781 adds a NULL check for the sub-context pointer before calling tcpedit_dlt_cleanup in the dlt_jnpr_ether_cleanup function [ref_id=1]. The commit message is "dlt_jnpr_ether_cleanup: check subctx before cleanup" [ref_id=1]. This prevents the reachable assertion by ensuring that tcpedit_dlt_cleanup is only invoked when the sub-context is non-NULL, matching the defensive pattern used by other DLT cleanup handlers.

Preconditions

  • inputAttacker must supply a crafted pcap file that triggers the DLT_JUNIPER_ETHER code path with a NULL sub-context.
  • configUser must run tcprewrite with --dlt="jnpr_eth" (or equivalent) pointing to the crafted file.

Reproduction

1. Compile tcpreplay version 4.4.3 (commit bcb107a). 2. Obtain the PoC pcap file referenced in the issue (linked from the GitHub issue). 3. Run: `./tcprewrite --dlt="jnpr_eth" -i $POC -o /dev/null` 4. Observe the assertion failure: `tcprewrite: plugins/dlt_plugins.c:462: tcpedit_dlt_cleanup: Assertion 'ctx' failed.` [ref_id=2]

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.