Executive brief
libpcap is a widely-used packet capture library that filters network traffic based on compiled filter rules. A flaw in the BPF interpreter allows a specially crafted filter program to cause an infinite loop, potentially freezing packet processing and causing denial of service. This vulnerability only affects uncommon use cases where external filter programs bypass libpcap's normal validation.
Technical details
The vulnerability exists in the pcapint_filter_with_aux_data() function, which interprets BPF bytecode. The "ja L" (unconditional jump) instruction's offset is treated as a signed integer, allowing backward jumps; however, the interpreter does not limit the number of loop iterations. A crafted external filter program can cause an infinite backward jump loop. The fix enforces a hard-coded limit on the number of backward jumps per packet and adds detection for immediately obvious infinite-loop patterns in pcapint_validate_filter(). This affects only programs from external sources via pcap_offline_filter() or the deprecated bpf_filter() function, not programs generated by libpcap's own compiler.
Affected products
- tcpdump.org libpcap
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: Fix committed (ff3c834) limiting backward jumps and validating filter programs