CVE-2020-8037
📋 TL;DR
CVE-2020-8037 is a memory allocation vulnerability in tcpdump's PPP decapsulator that allows attackers to trigger excessive memory consumption through specially crafted packets. This affects systems running vulnerable versions of tcpdump when processing network traffic. The vulnerability can lead to denial of service through resource exhaustion.
💻 Affected Systems
- tcpdump
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tcpdump by Tcpdump
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or denial of service due to memory exhaustion, potentially affecting multiple services on the same host.
Likely Case
Degraded performance or temporary service interruption of tcpdump and potentially other applications due to memory pressure.
If Mitigated
Minimal impact if tcpdump runs with limited privileges and memory constraints, or if vulnerable functionality is disabled.
🎯 Exploit Status
Exploitation requires sending specially crafted PPP packets to a system where tcpdump is running and processing traffic. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: tcpdump 4.9.4 and later
Vendor Advisory: https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231
Restart Required: No
Instructions:
1. Update tcpdump using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade tcpdump. 3. For RHEL/CentOS: sudo yum update tcpdump. 4. For Fedora: sudo dnf update tcpdump. 5. Verify installation with tcpdump --version.
🔧 Temporary Workarounds
Disable PPP processing
linuxRun tcpdump with filters to exclude PPP traffic
tcpdump not ppp
Limit tcpdump memory usage
linuxUse ulimit to restrict memory allocation for tcpdump processes
ulimit -v 1048576
tcpdump [options]
🧯 If You Can't Patch
- Restrict tcpdump to trusted network segments only
- Implement network filtering to block PPP traffic to monitoring systems
🔍 How to Verify
Check if Vulnerable:
Check tcpdump version: tcpdump --version | head -1. If version is 4.9.3 or earlier, system is vulnerable.Check Version:
tcpdump --version | head -1Verify Fix Applied:
After update, verify version is 4.9.4 or later: tcpdump --version | head -1📡 Detection & Monitoring
Log Indicators:
- System logs showing memory exhaustion
- tcpdump process crashes
- OOM killer activity related to tcpdump
Network Indicators:
- Unusual PPP traffic patterns
- High volume of PPP packets to monitoring interfaces
SIEM Query:
process_name:"tcpdump" AND (event_type:"crash" OR memory_usage:>90%)🔗 References
- http://seclists.org/fulldisclosure/2021/Apr/51
- https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231
- https://lists.debian.org/debian-lts-announce/2020/11/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2MX34MJIUJQGL6CMEPLTKFOOOC3CJ4Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWDBONZVLC6BAOR2KM376DJCM4H3FERV/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
- http://seclists.org/fulldisclosure/2021/Apr/51
- https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231
- https://lists.debian.org/debian-lts-announce/2020/11/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2MX34MJIUJQGL6CMEPLTKFOOOC3CJ4Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWDBONZVLC6BAOR2KM376DJCM4H3FERV/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
