CVE-2025-51006
📋 TL;DR
A double free vulnerability in tcpreplay's tcprewrite allows local attackers to cause denial of service through memory corruption by providing a specially crafted pcap file. This affects systems where tcprewrite is installed and used for packet manipulation. The vulnerability requires local access to execute the tcprewrite binary with malicious input.
💻 Affected Systems
- tcpreplay
📦 What is this software?
Tcpreplay by Broadcom
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or instability due to memory corruption, potentially leading to data loss or system unavailability.
Likely Case
Application crash (tcprewrite) causing denial of service for packet manipulation operations.
If Mitigated
No impact if tcprewrite is not used or if untrusted users cannot execute it with custom pcap files.
🎯 Exploit Status
Exploit requires local access to execute tcprewrite with crafted pcap file. Proof of concept available in GitHub references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest tcpreplay release (version TBD from vendor advisory)
Vendor Advisory: https://github.com/appneta/tcpreplay/issues/926
Restart Required: No
Instructions:
1. Check current tcpreplay version. 2. Update to latest version via package manager or source. 3. Verify fix by testing with known vulnerable pcap files.
🔧 Temporary Workarounds
Restrict tcprewrite execution
linuxLimit who can execute tcprewrite binary to prevent exploitation by untrusted users.
chmod 750 /usr/bin/tcprewrite
setfacl -m u:trusteduser:rx /usr/bin/tcprewrite
Input validation wrapper
allCreate wrapper script that validates pcap files before passing to tcprewrite.
#!/bin/bash
# Validate pcap before processing
if [ -f "$1" ]; then
# Add validation logic here
tcprewrite "$@"
fi
🧯 If You Can't Patch
- Remove or restrict execute permissions on tcprewrite binary
- Monitor for crash logs or unexpected tcprewrite process terminations
🔍 How to Verify
Check if Vulnerable:
Check tcpreplay version and compare with patched version from vendor advisory.Check Version:
tcprewrite --version 2>&1 | head -1Verify Fix Applied:
Test with proof-of-concept pcap file from GitHub references - should not crash.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from tcprewrite
- Unexpected process termination of tcprewrite
Network Indicators:
- None - local exploitation only
SIEM Query:
process.name:"tcprewrite" AND (event.action:"segmentation_fault" OR event.action:"crash")