CVE-2023-27783 – A denial-of-service vulnerability in TCPreplay'... (How to Fix)

Q: What is the severity of CVE-2023-27783?

CVE-2023-27783 has a CVSS score of 7.5 (HIGH). A denial-of-service vulnerability in TCPreplay's tcprewrite utility allows remote attackers to crash the application via a crafted packet. This affects systems running tcprewrite v4.4.3 for network traffic analysis or manipulation. The vulnerability is triggered through the tcpedit_dlt_cleanup function when processing malicious network data.

📋 TL;DR

A denial-of-service vulnerability in TCPreplay's tcprewrite utility allows remote attackers to crash the application via a crafted packet. This affects systems running tcprewrite v4.4.3 for network traffic analysis or manipulation. The vulnerability is triggered through the tcpedit_dlt_cleanup function when processing malicious network data.

💻 Affected Systems

Products:

TCPreplay tcprewrite

Versions: v4.4.3 (specifically mentioned), potentially earlier versions with similar code

Operating Systems: Linux, Unix-like systems where TCPreplay is commonly used

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems where tcprewrite is installed and used to process network traffic. The vulnerability is in the tcpedit_dlt_cleanup function in plugins/dlt_plugins.c.

📦 What is this software?

Tcpreplay by Broadcom

View all CVEs affecting Tcpreplay →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service disruption of tcprewrite processes, potentially affecting network analysis workflows and causing data loss during packet manipulation operations.

🟠

Likely Case

Application crash when processing malicious or malformed network packets, interrupting network traffic replay or editing tasks.

🟢

If Mitigated

Minimal impact if tcprewrite is not exposed to untrusted network traffic or if patched versions are used.

🌐 Internet-Facing: LOW - tcprewrite is typically used internally for network analysis and not directly internet-facing.

🏢 Internal Only: MEDIUM - Internal attackers or malicious network traffic could trigger the DoS condition in environments using tcprewrite for traffic analysis.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Remote attackers can trigger the vulnerability by sending crafted packets to systems processing traffic with tcprewrite.

The vulnerability is a reachable assertion (CWE-617) that can be triggered remotely. No public exploit code was found in the provided references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in TCPreplay versions after 4.4.3 (check specific commit in pull request #781)

Vendor Advisory: https://github.com/appneta/tcpreplay/issues/780

Restart Required: No

Instructions:

1. Update TCPreplay to the latest version. 2. For source installations: Pull latest code from GitHub and rebuild. 3. For package managers: Use system update commands (e.g., 'apt update && apt upgrade tcpreplay' on Debian/Ubuntu).

🔧 Temporary Workarounds

Restrict network access

linux

Limit tcprewrite exposure to trusted network sources only

Use firewall rules to restrict incoming traffic to tcprewrite processes
iptables -A INPUT -p tcp --dport [tcprewrite_port] -s [trusted_network] -j ACCEPT

Process only trusted traffic

all

Only use tcprewrite with known-good packet captures

Validate input PCAP files before processing with tcprewrite

🧯 If You Can't Patch

Isolate tcprewrite usage to secure, internal network segments with no external access
Implement monitoring for tcprewrite process crashes and investigate any unexpected terminations

🔍 How to Verify

Check if Vulnerable:

Check tcprewrite version: 'tcprewrite --version' or 'tcprewrite -V'. If output shows 4.4.3, the system is vulnerable.

Check Version:

tcprewrite --version

Verify Fix Applied:

After updating, run 'tcprewrite --version' to confirm version is newer than 4.4.3. Test with sample traffic to ensure no crashes.

📡 Detection & Monitoring

Log Indicators:

Sudden termination of tcprewrite processes
Core dumps or crash reports from tcprewrite
System logs showing segmentation faults in tcprewrite

Network Indicators:

Unusual network traffic patterns to systems running tcprewrite
Multiple connection attempts followed by service disruption

SIEM Query:

process_name:"tcprewrite" AND (event_type:"process_termination" OR event_type:"segmentation_fault")

📊 Metadata

CVE ID: CVE-2023-27783

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-617

Published: March 16, 2023

Last Updated: February 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-27783, you might also want to check these: