CVE-2024-8006: NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support
NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support
Other sources
Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcapfindalldevsex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8006?
CVE-2024-8006 has a moderate severity level due to the potential risk associated with enabled remote packet capture functionality.
How do I fix CVE-2024-8006?
To fix CVE-2024-8006, ensure that remote packet capture support is disabled in libpcap unless explicitly needed.
Which versions of libpcap are affected by CVE-2024-8006?
Libpcap versions prior to 1.10.5 are affected by CVE-2024-8006 if remote packet capture support is enabled.
What is the exploit for CVE-2024-8006?
CVE-2024-8006 can be exploited when a user provides a malicious filesystem path to the pcap_findalldevs_ex() function.
Is remote packet capture support enabled by default in libpcap?
No, remote packet capture support is disabled by default in libpcap.