NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Tcpdump Group | libpcap | 1.9.x; 1.10.x – 1.10.4 | — | No fix listed | CNA |
- libpcap VendorThe Tcpdump Group Affected 1.9.x; 1.10.x – 1.10.4 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tcpdump:libpcap:*:*:*:*:*:*:*:* | before 1.10.5 | Vulnerable | The Tcpdump Group |
- cpe:2.3:a:tcpdump:libpcap:*:*:*:*:*:*:*:* Versions before 1.10.5 Vulnerable ·The Tcpdump Group
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
Not affected: 4 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8006
- 2026-10-03 Alias added: GHSA-gj9v-677h-mwcx
References
More The Tcpdump Group Libpcap vulnerabilities
- TI-2011-01707 pcap-linux.c in libpcap 1.1.1 before commit ea9432fabdf4b33cbc76d9437200e028f1c47c93 when… CVSS 3.1CRITICAL 9.8
- TI-2019-11323 rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service… CVSS 3.1HIGH 7.5
- TI-2019-11325 sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. CVSS 3.1MEDIUM 5.3
- TI-2019-11324 rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. CVSS 3.1MEDIUM 5.3
- TI-2019-11321 rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse… CVSS 3.1MEDIUM 5.3
- TI-2019-11322 rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-8006 · CVE Program
- CVE-2024-8006 · NVD
- FIRST EPSS
- GHSA-gj9v-677h-mwcx · GitHub Advisory Database · CC BY 4.0
- CVE-2024-8006 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences