CVE-2023-27787 – A NULL pointer dereference vulnerability in TCP... (How to Fix)

Q: What is the severity of CVE-2023-27787?

CVE-2023-27787 has a CVSS score of 7.5 (HIGH). A NULL pointer dereference vulnerability in TCPprep v.4.4.3 allows remote attackers to cause denial of service by sending specially crafted input to the parse_list function. This affects systems running vulnerable versions of TCPprep, particularly those processing untrusted network traffic. The vulnerability can crash the application, disrupting packet replay functionality.

📋 TL;DR

A NULL pointer dereference vulnerability in TCPprep v.4.4.3 allows remote attackers to cause denial of service by sending specially crafted input to the parse_list function. This affects systems running vulnerable versions of TCPprep, particularly those processing untrusted network traffic. The vulnerability can crash the application, disrupting packet replay functionality.

💻 Affected Systems

Products:

TCPprep

Versions: v.4.4.3 specifically mentioned; earlier versions may also be affected

Operating Systems: Linux, Unix-like systems, Windows (if compiled from source)

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability triggers when processing malicious input through the parse_list function. Systems using TCPprep to process untrusted pcap files or network traffic are at highest risk.

📦 What is this software?

Tcpreplay by Broadcom

View all CVEs affecting Tcpreplay →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service disruption of TCPprep, causing packet replay operations to fail and potentially affecting dependent network testing or monitoring workflows.

🟠

Likely Case

Application crash when processing malicious input, requiring manual restart and causing temporary service interruption.

🟢

If Mitigated

Minimal impact if TCPprep runs in isolated environments without exposure to untrusted inputs.

🌐 Internet-Facing: MEDIUM - TCPprep typically processes captured traffic files rather than live internet traffic, but could be exposed if configured to handle external inputs.

🏢 Internal Only: MEDIUM - Internal systems using TCPprep for network testing could experience service disruption if processing malicious traffic captures.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires sending crafted input to trigger the NULL pointer dereference.

The CWE-476 (NULL Pointer Dereference) suggests straightforward exploitation by causing the application to dereference a NULL pointer, leading to crash.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check upstream repository for fixed version; references suggest fixes available in later releases

Vendor Advisory: https://github.com/appneta/tcpreplay/issues/788

Restart Required: Yes

Instructions:

1. Check current TCPprep version. 2. Update to latest version from official repository. 3. Recompile if using source. 4. Restart any TCPprep processes.

🔧 Temporary Workarounds

Input Validation

all

Validate and sanitize all input files before processing with TCPprep

Process Isolation

linux

Run TCPprep in isolated containers or sandboxes to limit impact of crashes

docker run --rm -v $(pwd):/data tcpreplay/tcpreplay

🧯 If You Can't Patch

Restrict TCPprep to process only trusted, validated pcap files from known sources
Implement monitoring and automatic restart mechanisms for TCPprep processes

🔍 How to Verify

Check if Vulnerable:

Check TCPprep version: tcpreplay --version | grep -i version

Check Version:

tcpreplay --version

Verify Fix Applied:

Verify version is updated beyond v4.4.3 and test with known safe traffic files

📡 Detection & Monitoring

Log Indicators:

Segmentation fault errors in system logs
TCPprep process crashes
Abnormal termination of packet replay sessions

Network Indicators:

Unexpected termination of network traffic replay
Failed packet processing jobs

SIEM Query:

process.name="tcpreplay" AND event.action="crashed" OR syslog.message="segmentation fault"

📊 Metadata

CVE ID: CVE-2023-27787

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: March 16, 2023

Last Updated: February 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-27787, you might also want to check these: