Bug 2165825 (CVE-2023-0411)

Summary:	CVE-2023-0411 wireshark: Multiple dissector excessive loops
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fhrdina, mruprich
Target Milestone:	---	Keywords:	Reopened, Security, Triaged
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	wireshark 4.0.3, wireshark 3.6.11	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the BPv6, NCP, and RTPS dissectors of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing excessive consumption of CPU resources due to excessive loops, resulting in a Denial of Service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-02-15 15:05:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2168676, 2168956, 2169833
Bug Blocks:	2165003

Description TEJ RATHI 2023-01-31 08:46:40 UTC

Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file.

References:
https://www.wireshark.org/security/wnpa-sec-2023-06.html
https://gitlab.com/wireshark/wireshark/-/issues/18711
https://gitlab.com/wireshark/wireshark/-/issues/18720
https://gitlab.com/wireshark/wireshark/-/issues/18737
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0411.json

Comment 1 Guilherme de Almeida Suckevicz 2023-02-09 17:58:42 UTC

Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 2168676]

Comment 4 Michal Ruprich 2023-02-15 15:05:24 UTC

Current version of wireshark in RHEL8 is 2.6.2 which means that bpv6 dissector is not part of our code base(added in later versions), the part of affected code for RTPS is also not present. As for NCP, I was not able to make wireshark crash with any of the provided .pcap files. I am closing this CVE. Feel free to reopen should you hit this or should you feel that this needs fixing in RHEL8.

Comment 5 Michal Ruprich 2023-02-15 15:07:49 UTC

Sorry, I meant to close the CVE bug for my component but closed the one for Security Response. Reopening.