Heap-buffer-overflow in pcapplusplus: pcpp::GREv1Layer::computeCalculateFields
Summary
OSV-2023-1145: Heap-buffer-overflow in pcpp::GREv1Layer::computeCalculateFields. Affects pcapplusplus versions >= 6a67cab6914074841ed81116ac72219ca070a44d, < a0ecc6dad71f445c95936697c7ee15997d5761b2. Fixed in a0ecc6dad71f445c95936697c7ee15997d5761b2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pcapplusplus is an open-source library that provides a high-level interface for capturing, parsing, and analyzing network packets. It is commonly used in network monitoring and analysis tools. The library allows users to work with various network protocols and provides functionality for packet manipulation and analysis. However, a vulnerability has been discovered in the library that can lead to a heap-buffer-overflow when processing GREv1 packets.
Vulnerability Detail
The vulnerability in pcapplusplus arises from a heap-buffer-overflow in the computeCalculateFields function of the GREv1Layer class. This function is responsible for calculating and updating the fields of a GREv1 packet. Due to insufficient bounds checking, an attacker can craft a malicious packet that triggers a write overflow, potentially leading to arbitrary code execution or a denial-of-service condition. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
a0ecc6dad71f445c95936697c7ee15997d5761b2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement additional input validation and bounds checking when processing GREv1 packets using pcapplusplus. By carefully validating the packet data and ensuring that it does not exceed the expected bounds, the risk of triggering the heap-buffer-overflow can be mitigated. Here is an example of how to perform input validation for GREv1 packets:
void processGREv1Packet(pcpp::Packet& packet) {
pcpp::GREv1Layer* greLayer = packet.getLayerOfType<pcpp::GREv1Layer>();
if (greLayer) {
size_t expectedSize = sizeof(pcpp::gre_basic_header) + greLayer->getHeaderLen();
if (packet.getRawPacket()->getRawDataLen() >= expectedSize) {
// Process the packet
}
}
}
Conclusion
In conclusion, the vulnerability in pcapplusplus poses a significant risk to systems that utilize the library for network packet analysis. It is crucial for users to update to a fixed version of pcapplusplus and implement appropriate input validation to mitigate the risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pcapplusplus →
FAQ
pcapplusplus is an open-source library for capturing, parsing, and analyzing network packets. It provides a high-level interface for working with various network protocols.
A heap-buffer-overflow is a type of memory corruption vulnerability where a program writes data beyond the bounds of a heap-allocated buffer. This can lead to various security issues, including arbitrary code execution or denial-of-service.
The vulnerability in pcapplusplus can be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. This can potentially lead to unauthorized access, data breaches, or disruption of network services.
Yes, the vulnerability has been fixed in a commit with the hash a0ecc6dad71f445c95936697c7ee15997d5761b2 on the GitHub repository. Users should update their pcapplusplus dependency to a version that includes this fix.
Yes, users can implement additional input validation and bounds checking when processing GREv1 packets using pcapplusplus. By carefully validating the packet data, the risk of triggering the heap-buffer-overflow can be mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcapplusplus.
