Bug 2308785 (CVE-2024-8006)

Summary: CVE-2024-8006 libpcap: NULL pointer derefence in pcap_findalldevs_ex() in pcap-new.c
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, ansasaki, carlosrodrifernandez, kshier, omaciel, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the libpcap library. When remote packet capture support is enabled, it is possible to trigger a NULL pointer dereference when a filesystem path that is not a directory is used as an argument to the pcap_findalldevs_ex function due to a missing check of the return value from the opendir function, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2308973, 2308974    
Bug Blocks:    

Description OSIDB Bzimport 2024-08-31 00:21:01 UTC 
Remote packet capture support is disabled by default in libpcap.  When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex().  One of the function arguments can be a filesystem path, which normally means a directory with input data files.  When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.
Comment 2 Carlos Rodriguez-Fernandez 2024-09-02 20:03:57 UTC 
libcap 2.48, 2.69, or 2.170 doesn't have "pcap_findalldevs_ex".

Also the OSIDB import refers to libpcap ("p" in the middle). A different library
Comment 3 Carlos Rodriguez-Fernandez 2024-09-02 20:12:27 UTC 
You created the issue for libcap, but I think you meant libpcap: https://src.fedoraproject.org/rpms/libpcap