Executive brief
libpcap is a widely-used network packet capture library that processes packet filtering rules. A flaw in the BPF (Berkeley Packet Filter) interpreter allows crafted filter programs to read arbitrary memory outside the filter buffer, potentially exposing sensitive OS process data. An attacker supplying a malicious filter program could crash the application or leak sensitive information.
Technical details
The BPF interpreter in libpcap's pcapint_filter_with_aux_data() function does not validate that jump instructions remain within the filter program buffer or that execution reaches a return instruction. When a malformed filter program from an external source (via pcap_offline_filter() or bpf_filter()) causes the program counter to advance beyond the buffer bounds, the interpreter attempts to execute and read arbitrary memory, potentially covering 32 GiB on 64-bit systems or the entire address space on 32-bit systems. This can result in SIGSEGV or abort(). The fix adds a parameter specifying the number of instructions and performs bounds checking before executing instructions.
Affected products
- tcpdump.org libpcap <unknown
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched