CVE-2018-16227
📋 TL;DR
This vulnerability is a buffer over-read in tcpdump's IEEE 802.11 parser when processing Mesh Flags subfields. It allows attackers to cause denial of service or potentially leak memory contents by sending specially crafted wireless network packets. Anyone using tcpdump versions before 4.9.3 to analyze wireless network traffic is affected.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities, or sensitive memory disclosure revealing credentials or encryption keys.
Likely Case
Denial of service causing tcpdump to crash when parsing malicious wireless packets, potentially disrupting network monitoring or security analysis.
If Mitigated
Limited impact with proper network segmentation and restricted access to wireless interfaces; tcpdump crashes but system remains stable.
🎯 Exploit Status
Exploitation requires ability to send malicious wireless packets to a system where tcpdump is running. Proof of concept code is publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: tcpdump 4.9.3 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
Restart Required: No
Instructions:
1. Download tcpdump 4.9.3 or later from the official repository. 2. Compile and install following standard build procedures. 3. Replace existing tcpdump binary with the patched version.
🔧 Temporary Workarounds
Disable wireless packet capture
allPrevent tcpdump from parsing IEEE 802.11 wireless traffic by using filters or avoiding wireless interfaces.
tcpdump -i eth0
tcpdump not type mgt subtype beacon
Restrict tcpdump privileges
linuxRun tcpdump with reduced privileges using capabilities or as non-root user.
setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
sudo -u nobody tcpdump
🧯 If You Can't Patch
- Restrict network access to systems running tcpdump, especially wireless interfaces
- Monitor for tcpdump crashes and investigate any abnormal termination events
🔍 How to Verify
Check if Vulnerable:
Run 'tcpdump --version' and check if version is earlier than 4.9.3Check Version:
tcpdump --version 2>&1 | head -1Verify Fix Applied:
Confirm tcpdump version is 4.9.3 or later with 'tcpdump --version'📡 Detection & Monitoring
Log Indicators:
- tcpdump segmentation fault logs
- core dumps from tcpdump process
- abnormal tcpdump termination in system logs
Network Indicators:
- Unusual wireless traffic patterns targeting monitoring systems
- Malformed IEEE 802.11 packets with Mesh Flags
SIEM Query:
process_name:tcpdump AND (event_type:crash OR exit_code:139 OR signal:SIGSEGV)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/4846b3c5d0a850e860baf4f07340495d29837d09
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES
- https://github.com/the-tcpdump-group/tcpdump/commit/4846b3c5d0a850e860baf4f07340495d29837d09
- https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/
- https://seclists.org/bugtraq/2019/Dec/23
- https://seclists.org/bugtraq/2019/Oct/28
- https://security.netapp.com/advisory/ntap-20200120-0001/
- https://support.apple.com/kb/HT210788
- https://usn.ubuntu.com/4252-1/
- https://usn.ubuntu.com/4252-2/
- https://www.debian.org/security/2019/dsa-4547
