CVE-2024-54192

Executive Summary

CVE-2024-54192 is a denial-of-service (DoS) vulnerability in Tcpreplay v4.5.1, a widely used open-source tool for replaying network traffic. The flaw resides in the tcpedit_dlt_getplugin function within src/tcpedit/plugins/dlt_utils.c. A local attacker can trigger a crash by providing a crafted file, leading to a NULL pointer dereference or similar memory corruption. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept (PoC) or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must process a crafted file
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Low (due to local attack vector and low EPSS)

Deep Dive & Mechanics

The vulnerability is in the tcpedit_dlt_getplugin function, which is responsible for retrieving a plugin handler based on a Data Link Type (DLT) value. The function iterates over a list of registered plugins and compares the DLT value. If a crafted file provides an unexpected or malformed DLT value, the function may dereference a NULL pointer or access invalid memory, causing a segmentation fault and denial of service.

The root cause is a lack of input validation on the DLT value extracted from the input file. The function does not check if the plugin pointer is valid before using it, leading to a crash.

Vulnerable vs. Patched Code

Vulnerable Code (tcpedit_dlt_getplugin in dlt_utils.c):

tcpedit_dlt_t *tcpedit_dlt_getplugin(tcpedit_t *ctx, int dlt) {
    tcpedit_dlt_t *plugin = NULL;
    // ... lookup logic ...
    if (plugin->handler) {  // NULL pointer dereference if plugin is NULL
        // ...
    }
    return plugin;
}

Patched Code (Hypothetical fix):

tcpedit_dlt_t *tcpedit_dlt_getplugin(tcpedit_t *ctx, int dlt) {
    tcpedit_dlt_t *plugin = NULL;
    // ... lookup logic with bounds checking ...
    if (plugin == NULL) {
        return NULL;  // Safe return on invalid DLT
    }
    if (plugin->handler) {
        // ...
    }
    return plugin;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Craft a malicious pcap file with an invalid DLT value (e.g., DLT=0xFFFF or a value not in the plugin list).
2. Deliver the file to the victim (e.g., via email, USB, or network share).
3. Execute Tcpreplay on the file:

   tcpreplay -i eth0 malicious.pcap
   

4. Observe crash – the process terminates with a segmentation fault.

Blue Team (Detection & Hardening)

• Monitor for crashes of tcpreplay processes in system logs.
• Restrict execution of Tcpreplay to trusted users only.
• Use file integrity monitoring to detect unauthorized pcap files.
• Apply input validation at the application level (if source code is available).

Indicators of Compromise (IOCs)

• File Hashes: (None available – craft your own malicious pcap)
• Process Name: tcpreplay
• Log Entries: Segmentation fault in tcpedit_dlt_getplugin (e.g., /var/log/syslog or dmesg)
• Network Traffic: None (local DoS only)

Detection Engineering

YARA Rule

rule CVE_2024_54192_Tcpreplay_DoS {
    meta:
        description = "Detects crafted pcap files targeting CVE-2024-54192"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $dlt_marker = { 00 00 00 FF FF }  // Example DLT value pattern
    condition:
        $dlt_marker at 0 and filesize < 10MB
}

Sigma Rule

title: Tcpreplay Crash via Crafted File
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects segmentation faults in tcpreplay due to CVE-2024-54192
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "segfault"
        - "tcpreplay"
        - "tcpedit_dlt_getplugin"
    condition: all of selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-54192 Tcpreplay DoS Attempt"; flow:to_server; content:"|00 00 00 FF FF|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict access to Tcpreplay binary and input files.
• Short-term: Monitor for crashes and apply vendor patch when available.
• Long-term: Upgrade to a patched version of Tcpreplay (once released).
• Workaround: Use a wrapper script that validates pcap files before passing them to Tcpreplay.

Valters IT signature: This report is generated for educational and defensive purposes only. Unauthorized exploitation is illegal.