NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support

Vulnerability

In libpcap versions built with remote packet capture support enabled (e.g., using --enable-remote), the function pcap_findalldevs_ex() does not check the return value of opendir(). When a user-supplied path cannot be opened as a directory, opendir() returns NULL, which is then passed directly to readdir(), leading to a NULL pointer dereference. This issue affects libpcap builds prior to commits [1] and [2].

Exploitation

An attacker with the ability to specify the filesystem path argument to pcap_findalldevs_ex() (e.g., through a crafted remote capture input) can trigger this vulnerability. No authentication is required if the attacker can control the source parameter. The attacker provides a path that does not exist or is not a directory, causing the NULL pointer dereference.

Impact

A successful NULL pointer dereference results in a crash, leading to a denial of service of the application using libpcap. There is no evidence of code execution or privilege escalation from this vulnerability.

Mitigation

The fix is implemented in commits 0f8a103 [1] and 8a633ee [2], which add a NULL check after opendir() and return an error. Users should update libpcap to a version containing these commits (e.g., libpcap >= 1.10.5 or later). If an update is not possible, disable remote packet capture support when building libpcap.