CVE-2020-15475
📋 TL;DR
CVE-2020-15475 is a use-after-free vulnerability in nDPI's packet processing function ndpi_reset_packet_line_info. This allows attackers to potentially execute arbitrary code or cause denial of service by sending specially crafted network packets. Any system using vulnerable versions of nDPI for deep packet inspection is affected.
💻 Affected Systems
- nDPI (ntop Deep Packet Inspection library)
📦 What is this software?
Ndpi by Ntop
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service causing nDPI to crash, disrupting network monitoring and security functions.
If Mitigated
Limited impact if nDPI runs in isolated environments with proper memory protection mechanisms.
🎯 Exploit Status
Exploitation requires sending specially crafted network packets to trigger the use-after-free condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 6a9f5e4f7c3fd5ddab3e6727b071904d76773952 and later versions
Vendor Advisory: https://github.com/ntop/nDPI/commit/6a9f5e4f7c3fd5ddab3e6727b071904d76773952
Restart Required: Yes
Instructions:
1. Update nDPI to version after commit 6a9f5e4f7c3fd5ddab3e6727b071904d76773952. 2. Recompile any applications using nDPI. 3. Restart services using nDPI.
🔧 Temporary Workarounds
Network segmentation
allRestrict network access to systems using nDPI to minimize attack surface
Disable nDPI if not essential
allTemporarily disable nDPI-based inspection if functionality is not critical
🧯 If You Can't Patch
- Implement strict network filtering to limit packets reaching nDPI systems
- Monitor for crashes or abnormal behavior in nDPI processes
🔍 How to Verify
Check if Vulnerable:
Check nDPI version: if version ≤ 3.2, system is vulnerable. Also check if commit 6a9f5e4f7c3fd5ddab3e6727b071904d76773952 is not present.Check Version:
Check nDPI source code or compiled library version. For ntopng: check version in web interface or configuration.Verify Fix Applied:
Verify nDPI version is > 3.2 or contains commit 6a9f5e4f7c3fd5ddab3e6727b071904d76773952.📡 Detection & Monitoring
Log Indicators:
- nDPI process crashes
- Memory access violation errors in system logs
- Abnormal termination of packet inspection services
Network Indicators:
- Unusual packet patterns targeting nDPI ports
- Spike in malformed packets
SIEM Query:
Process: nDPI OR ndpi AND (EventID: 1000 OR "segmentation fault" OR "access violation")