CVE-2021-22235
📋 TL;DR
This vulnerability in Wireshark's DNP (Distributed Network Protocol) dissector allows attackers to cause a denial of service crash by injecting malicious packets or providing a specially crafted capture file. It affects Wireshark users analyzing DNP3 traffic, particularly in industrial control and utility environments.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Complete Wireshark crash leading to loss of network monitoring capabilities during critical operations, potentially disrupting network analysis and incident response activities.
Likely Case
Wireshark crashes when processing malicious DNP3 packets or capture files, requiring restart and potentially losing unsaved analysis data.
If Mitigated
No impact if Wireshark is not used to analyze DNP3 traffic or if patched versions are deployed.
🎯 Exploit Status
Exploitation requires ability to inject packets into monitored network or provide malicious capture file; proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 3.4.7 and 3.2.15
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2021-08.html
Restart Required: Yes
Instructions:
1. Download latest Wireshark version from wireshark.org. 2. Install over existing version. 3. Restart Wireshark and any related services.
🔧 Temporary Workarounds
Disable DNP dissector
allPrevent Wireshark from parsing DNP3 protocol traffic
Edit preferences -> Protocols -> DNP -> Uncheck 'Enable DNP'
Use capture filters
allFilter out DNP3 traffic from being captured
Use capture filter: not port 20000
🧯 If You Can't Patch
- Restrict Wireshark use to trusted networks only
- Implement network segmentation to limit exposure to DNP3 traffic
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version: Help -> About WiresharkCheck Version:
wireshark --versionVerify Fix Applied:
Verify version is 3.4.7+ or 3.2.15+ and test with known malicious DNP3 capture files📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs
- Application error events mentioning Wireshark
Network Indicators:
- Unusual DNP3 traffic patterns
- Malformed DNP3 packets
SIEM Query:
source="wireshark.log" AND ("crash" OR "segmentation fault" OR "access violation")🔗 References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22235.json
- https://gitlab.com/wireshark/wireshark/-/issues/17462
- https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
- https://security.gentoo.org/glsa/202210-04
- https://www.debian.org/security/2021/dsa-5019
- https://www.wireshark.org/security/wnpa-sec-2021-05.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22235.json
- https://gitlab.com/wireshark/wireshark/-/issues/17462
- https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
- https://security.gentoo.org/glsa/202210-04
- https://www.debian.org/security/2021/dsa-5019
- https://www.wireshark.org/security/wnpa-sec-2021-05.html
