Bug 1655374 (CVE-2018-19519) - CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap
Summary: CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c:print_pr...
Alias: CVE-2018-19519
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
: CVE-2019-1010220 (view as bug list)
Depends On: 1655621 1655622 1761349
Blocks: 1655376 1735552
TreeView+ depends on / blocked
Reported: 2018-12-03 03:55 UTC by Sam Fowler
Modified: 2023-03-24 14:24 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-11-26 19:04:49 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3976 0 None None None 2019-11-26 13:58:05 UTC
Red Hat Product Errata RHSA-2020:1604 0 None None None 2020-04-28 15:28:57 UTC

Description Sam Fowler 2018-12-03 03:55:06 UTC
In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.



Comment 1 Sam Fowler 2018-12-03 04:00:47 UTC
Could not reproduce with tcpdump-4.9.2-6.fc29.i686:

$ ldd $(which tcpdump) | grep asan
        libasan.so.5 => /lib/libasan.so.5 (0xf7575000)
$ tcpdump -ee -vv -nnr id_57.pcap
reading from file id_57.pcap, link-type EN10MB (Ethernet)
07:52:49.784807 08:00:25:d4:10:bb > 08:00:27:10:8f:95, ethertype IPv6 (0x86dd), length 16: truncated-ip6 2
07:52:49.892740 08:00:27:da:8f:95 > 33:33:00:00:ff:fe, ethertype IPv6 (0x86dd), length 32929: truncated-ip6 - 32511 bytes missing!(flowlabel 0x0fdff, hlim 0, next-header UDP (17) payload length: 65386) 80ff:ff00::a00:6873:7570:6c6f.8231 > 7274:a43:6f70:7972:6967:6874:3328:6329.14648: hncp (13861)
        Future use: type=13312 (12)
        Unassigned: type=128 (4)
        Assigned-Prefix (48) EPID: ff000000 Prty: 5 Prefix: ��V�2���  (invalid)
        Reserved: type=0 (20)
        Future use: type=12 (14)
tcpdump: pcap_loop: truncated dump file; tried to read 8 bytes, only got 4

Comment 2 Stefan Cornelius 2018-12-03 15:09:00 UTC

This issue affects the versions of tcpdump as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of tcpdump as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 6 Stefan Cornelius 2019-08-07 10:16:13 UTC
*** Bug 1735549 has been marked as a duplicate of this bug. ***

Comment 7 errata-xmlrpc 2019-11-26 13:58:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3976 https://access.redhat.com/errata/RHSA-2019:3976

Comment 8 Product Security DevOps Team 2019-11-26 19:04:49 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 9 errata-xmlrpc 2020-04-28 15:28:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1604 https://access.redhat.com/errata/RHSA-2020:1604

Note You need to log in before you can comment on or make changes to this bug.