Log in Start free

Vulnerability · Published Aug 30, 2024 · Assigned by Tcpdump

CVE-2023-7256Double-free in libpcap before 1.10.5 with remote packet capture support.

Medium 4.4

In plain English

A medium-severity double free in libpcap from The Tcpdump Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 84.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libpcapno fix listedDEBIAN-CVE-2023-7256
Debian:13libpcap1.10.5-1DEBIAN-CVE-2023-7256
Debian:14libpcap1.10.5-1DEBIAN-CVE-2023-7256

Affected products (as reported)

VendorProductVersions
The Tcpdump Group libpcap 1.8.x1.9.x1.10.x – through 1.10.4

Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References