Heap-based Buffer Overflow in PcapPlusPlus LightPcapNg Parser

Executive Summary

This vulnerability is a heap-based buffer overflow found in the LightPcapNg parser component of seladb PcapPlusPlus version 25.05. Specifically, it occurs in the function parse_by_block_type within the file light_pcapng.c. The issue arises when the argument captured_packet_length is manipulated, leading to an overflow during a memcpy operation because the length value is not properly validated. This can be triggered remotely by an attacker providing a malicious packet length.

The vulnerability was discovered through fuzz testing using AddressSanitizer, which showed that the allocated heap buffer was smaller than the requested copy length, causing the overflow. The exploit has been made public and can be used, although the attack complexity is high and exploitability is difficult.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a heap-buffer-overflow condition that may cause information disclosure or denial of service when processing malicious packets. An attacker could exploit this remotely by sending crafted packets with manipulated lengths, potentially causing the affected application to crash or leak sensitive information.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability in PcapPlusPlus 25.05's LightPcapNg parser can be detected by using fuzz testing tools such as AddressSanitizer, which revealed the heap-buffer-overflow during testing. Specifically, the issue occurs in the parse_by_block_type() function when processing malicious packet lengths.

To detect exploitation attempts or presence of this vulnerability, you can monitor for crashes or abnormal behavior in applications using PcapPlusPlus when processing pcapng files.

While no direct detection commands are provided, you can use tools like AddressSanitizer with fuzzers (e.g., FuzzTargetNg) on your PcapPlusPlus-based applications to identify the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding processing untrusted or malicious pcapng files with the vulnerable version (25.05) of PcapPlusPlus.

If possible, update or patch the PcapPlusPlus library to a version where this vulnerability is fixed.

Additionally, consider running applications that use PcapPlusPlus with memory protection tools such as AddressSanitizer to detect and prevent exploitation.

Useful 0 Not Useful 0