Executive brief
libpcap is a widely-used library for capturing and processing network traffic packets. A flaw in its Berkeley Packet Filter (BPF) interpreter allows an attacker to craft a malicious filter program that triggers an unexpected abort, crashing any application using libpcap to filter network traffic. This can disrupt network monitoring tools, security appliances, and any service relying on libpcap for packet filtering.
Technical details
The vulnerability exists in the BPF interpreter function pcapint_filter_with_aux_data(), which calls abort() when it encounters a BPF instruction with an invalid opcode. While libpcap-generated programs are assumed to never have invalid opcodes, programs from external sources (e.g., via pcap_offline_filter() or the deprecated bpf_filter()) may contain invalid opcodes due to gaps in the validator. An attacker can supply a crafted BPF filter program to cause immediate process termination. The fix changes the interpreter to safely reject packets with invalid opcodes instead of calling abort().
Affected products
- tcpdump.org libpcap
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: Fix implemented in commit a715bcd