CVE-2025-51006

Executive Summary

CVE-2025-51006 describes a double-free vulnerability within the tcprewrite utility of the tcpreplay suite. The flaw resides in the dlt_linuxsll2_cleanup() function within plugins/dlt_linuxsll2/linuxsll2.c. When tcpedit_dlt_cleanup() is called, it can indirectly invoke the cleanup routine multiple times on the same memory region, leading to a double-free condition. By supplying a specially crafted pcap file, a local attacker can trigger this vulnerability, causing memory corruption and resulting in a Denial of Service (DoS). The vulnerability is currently unpatched, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability affects the tcpreplay package, which is commonly distributed through package managers like apt, yum, and brew, as well as compiled from source. Users are advised to monitor official distribution channels for updates.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full vector has not been assigned. However, based on the description, the following assessment can be made:

• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - The attack requires a crafted pcap file, but no special conditions.
• Privileges Required (PR): Low (L) - The attacker needs to be able to execute tcprewrite.
• User Interaction (UI): None (N) - The victim does not need to perform any action beyond running the tool.
• Scope (S): Unchanged (U) - The vulnerability affects the same security authority.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): High (H) - The vulnerability leads to a Denial of Service.

Threat Level: Medium (Local DoS)

Deep Dive & Mechanics

The vulnerability is a classic double-free bug in C code. The dlt_linuxsll2_cleanup() function is responsible for freeing memory allocated for the Linux SLL2 (Linux cooked capture v2) data link type. The issue arises because tcpedit_dlt_cleanup() can call this cleanup function more than once on the same pointer without resetting the pointer to NULL after the first free. When the second free occurs, the heap metadata is corrupted, leading to a crash or potentially exploitable memory corruption.

The call chain is:

1. User runs tcprewrite with a crafted pcap file.
2. The pcap file triggers the use of the Linux SLL2 DLT.
3. During cleanup, tcpedit_dlt_cleanup() is called.
4. This function calls dlt_linuxsll2_cleanup().
5. Due to a logic error, dlt_linuxsll2_cleanup() is called twice on the same memory region.
6. The second call to free() on an already freed pointer causes a double-free.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve setting the freed pointer to NULL after the first free.

Vulnerable Code (Conceptual):

void dlt_linuxsll2_cleanup() {
    if (some_pointer) {
        free(some_pointer);
        // Missing: some_pointer = NULL;
    }
}

Patched Code (Hypothetical):

void dlt_linuxsll2_cleanup() {
    if (some_pointer) {
        free(some_pointer);
        some_pointer = NULL; // Prevent double-free
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a system with tcprewrite installed.
• Ability to create a crafted pcap file.

Steps:

1. Create a malicious pcap file that triggers the Linux SLL2 DLT and causes the double-free.
2. Run tcprewrite with the crafted pcap file:

   tcprewrite --infile=malicious.pcap --outfile=output.pcap
   

3. The tool will crash, causing a Denial of Service.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Defense & Detection)

Mitigation:

• Restrict local access to systems running tcprewrite.
• Monitor for crashes of tcprewrite in system logs.
• Use file integrity monitoring to detect the introduction of suspicious pcap files.

Detection:

• Monitor for abnormal termination of tcprewrite.
• Look for core dumps or segfaults in /var/log/syslog or journalctl.

Indicators of Compromise (IOCs)

• File: Suspicious pcap files that trigger the vulnerability.
• Process: tcprewrite crashing with a segfault or abort signal.
• Log Entry: Entries in system logs indicating a crash of tcprewrite (e.g., "segfault at ...").
• Memory: Heap corruption patterns associated with double-free.

Detection Engineering

YARA Rule

rule CVE_2025_51006_Tcprewrite_DoubleFree {
    meta:
        description = "Detects crafted pcap files targeting CVE-2025-51006"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51006"
    strings:
        $sll2_magic = { 00 00 00 0A } // Example magic for Linux SLL2
        $double_free_pattern = { 48 8B 45 ?? 48 85 C0 74 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? } // Hypothetical pattern
    condition:
        $sll2_magic at 0 and $double_free_pattern
}

Sigma Rule

title: Tcprewrite Crash Detection
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects crashes of tcprewrite indicative of CVE-2025-51006 exploitation
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/tcprewrite'
        ExitCode: -11  # SIGSEGV
    condition: selection
falsepositives:
    - Legitimate crashes due to malformed pcap files
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-51006 Potential Tcprewrite Double-Free Exploit"; flow:to_server; content:"|00 00 00 0A|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Restrict execution of tcprewrite to trusted users only.
• Avoid processing untrusted pcap files with tcprewrite.
• Monitor for updates from the tcpreplay project.

Long-term Fix:

• Apply a patch from the vendor once available.
• Consider compiling tcprewrite with AddressSanitizer (ASan) to detect memory corruption during testing.

Workaround:

• Use alternative tools for pcap manipulation until a patch is released.

Valters IT
Securing Digital Frontiers