CVE-2021-39929
📋 TL;DR
This vulnerability allows denial of service attacks against Wireshark through uncontrolled recursion in the Bluetooth DHT dissector. Attackers can crash Wireshark by injecting malicious packets or providing crafted capture files. Users running affected Wireshark versions 3.4.0-3.4.9 or 3.2.0-3.2.17 are vulnerable.
💻 Affected Systems
- Wireshark
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Wireshark crashes repeatedly, preventing network analysis and potentially causing data loss if analyzing critical captures during an incident.
Likely Case
Wireshark crashes when processing malicious Bluetooth traffic or specially crafted capture files, disrupting network analysis workflows.
If Mitigated
With proper network segmentation and updated software, impact is limited to isolated analysis systems with minimal operational disruption.
🎯 Exploit Status
Exploitation requires sending malicious Bluetooth packets to the network or providing crafted capture files; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 3.4.10 and 3.2.18
Vendor Advisory: https://gitlab.com/wireshark/wireshark/-/issues/17651
Restart Required: Yes
Instructions:
1. Download latest Wireshark from wireshark.org 2. Install over existing version 3. Restart system or at least Wireshark processes
🔧 Temporary Workarounds
Disable Bluetooth DHT dissector
allPrevent Wireshark from using the vulnerable dissector
wireshark -o bluetooth.dht.enable_dissector:FALSE
Network segmentation
allIsolate Wireshark systems from untrusted networks
🧯 If You Can't Patch
- Restrict Wireshark usage to trusted networks only
- Monitor for abnormal Wireshark crashes and investigate source
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version: if between 3.4.0-3.4.9 or 3.2.0-3.2.17, you are vulnerableCheck Version:
wireshark -v | head -1Verify Fix Applied:
Verify Wireshark version is 3.4.10+ or 3.2.18+📡 Detection & Monitoring
Log Indicators:
- Multiple Wireshark crashes in system logs
- Segmentation fault errors from Wireshark processes
Network Indicators:
- Unusual Bluetooth packet patterns targeting analysis systems
- Malformed Bluetooth DHT packets
SIEM Query:
source="system_logs" AND process="wireshark" AND (event="segmentation fault" OR event="crash")🔗 References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39929.json
- https://gitlab.com/wireshark/wireshark/-/issues/17651
- https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6AJFIYIHS3TYDD2EBYBJ5KKE52X34BJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YEWTIRMC2MFQBZ2O5M4CJHJM4JPBHLXH/
- https://security.gentoo.org/glsa/202210-04
- https://www.debian.org/security/2021/dsa-5019
- https://www.wireshark.org/security/wnpa-sec-2021-07.html
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39929.json
- https://gitlab.com/wireshark/wireshark/-/issues/17651
- https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6AJFIYIHS3TYDD2EBYBJ5KKE52X34BJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YEWTIRMC2MFQBZ2O5M4CJHJM4JPBHLXH/
- https://security.gentoo.org/glsa/202210-04
- https://www.debian.org/security/2021/dsa-5019
- https://www.wireshark.org/security/wnpa-sec-2021-07.html
