Bug 1655374 (CVE-2018-19519) - CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap
Summary: CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c:print_pr...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-19519
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: CVE-2019-1010220 (view as bug list)
Depends On: 1655621 1655622 1761349
Blocks: 1655376 1735552
TreeView+ depends on / blocked
 
Reported: 2018-12-03 03:55 UTC by Sam Fowler
Modified: 2023-03-24 14:24 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-11-26 19:04:49 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3976 0 None None None 2019-11-26 13:58:05 UTC
Red Hat Product Errata RHSA-2020:1604 0 None None None 2020-04-28 15:28:57 UTC

Description Sam Fowler 2018-12-03 03:55:06 UTC 
In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.


Reference:

https://github.com/zyingp/temp/blob/master/tcpdump.md
Comment 1 Sam Fowler 2018-12-03 04:00:47 UTC 
Could not reproduce with tcpdump-4.9.2-6.fc29.i686:

$ ldd $(which tcpdump) | grep asan
        libasan.so.5 => /lib/libasan.so.5 (0xf7575000)
$ tcpdump -ee -vv -nnr id_57.pcap
reading from file id_57.pcap, link-type EN10MB (Ethernet)
07:52:49.784807 08:00:25:d4:10:bb > 08:00:27:10:8f:95, ethertype IPv6 (0x86dd), length 16: truncated-ip6 2
07:52:49.892740 08:00:27:da:8f:95 > 33:33:00:00:ff:fe, ethertype IPv6 (0x86dd), length 32929: truncated-ip6 - 32511 bytes missing!(flowlabel 0x0fdff, hlim 0, next-header UDP (17) payload length: 65386) 80ff:ff00::a00:6873:7570:6c6f.8231 > 7274:a43:6f70:7972:6967:6874:3328:6329.14648: hncp (13861)
        Future use: type=13312 (12)
        Unassigned: type=128 (4)
        Assigned-Prefix (48) EPID: ff000000 Prty: 5 Prefix: ��V�2���  (invalid)
        Reserved: type=0 (20)
        Future use: type=12 (14)
        [|hncp]
tcpdump: pcap_loop: truncated dump file; tried to read 8 bytes, only got 4
Comment 2 Stefan Cornelius 2018-12-03 15:09:00 UTC 
Statement:

This issue affects the versions of tcpdump as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of tcpdump as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 6 Stefan Cornelius 2019-08-07 10:16:13 UTC 
*** Bug 1735549 has been marked as a duplicate of this bug. ***
Comment 7 errata-xmlrpc 2019-11-26 13:58:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3976 https://access.redhat.com/errata/RHSA-2019:3976
Comment 8 Product Security DevOps Team 2019-11-26 19:04:49 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-19519
Comment 9 errata-xmlrpc 2020-04-28 15:28:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1604 https://access.redhat.com/errata/RHSA-2020:1604
Note You need to log in before you can comment on or make changes to this bug.