CVE-2024-8006 NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support

What is CVE-2024-8006?

CVE-2024-8006 is a medium-severity vulnerability in The Tcpdump Group libpcap, published on 30 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.

Weakness: CWE-476

Which versions are affected by CVE-2024-8006?

It affects 1 product.

Products include Tcpdump Libpcap.

How do I fix CVE-2024-8006?

Upgrade to a fixed version.

Is CVE-2024-8006 being exploited?

There is no known exploitation of CVE-2024-8006 in the wild and no public exploit code.

Other vulnerabilities in The Tcpdump Group libpcap

• CVE-2011-1935 Information disclosure in n/a Critical 9.8
• CVE-2019-15163 Null dereference in n/a High 7.5
• CVE-2019-15161 Integer overflow in n/a Medium 5.3
• CVE-2019-15162 Information disclosure in n/a Medium 5.3
• CVE-2019-15164 Server-side request forgery in n/a Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-48409, AZL-48412, AZL-48438, AZL-48462, CLEANSTART-2026-MM14212, DEBIAN-CVE-2024-8006 and 3 more.