Executive brief
libpcap is a network packet capture library used in tools like tcpdump and packet analysis software. A flaw in the BPF (Berkeley Packet Filter) interpreter fails to check for zero values when performing division or modulo operations, allowing a crafted filter program to trigger a division-by-zero error that crashes the application.
Technical details
The vulnerability exists in the BPF interpreter's handling of 'div #k' and 'mod #k' ALU (arithmetic/logic unit) instructions, where k is an immediate constant value. While the interpreter correctly validates that the X register is non-zero for 'div x' and 'mod x' operations, it assumes k is never zero for immediate-value instructions. However, external filter programs passed via pcap_offline_filter() or bpf_filter() may not have been validated by libpcap, allowing an attacker to supply a crafted filter containing division or modulo by zero. Exploitation requires network reachability or the ability to supply a malicious filter program; when executed, this causes a SIGFPE signal that terminates the process. The fix treats 'div #k' and 'mod #k' the same as variable-operand instructions by explicitly checking for zero before division.
Affected products
- The Tcpdump Group libpcap <UNKNOWN>
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: Patch available via commit 98bb921