CVE-2025-9385
📋 TL;DR
A use-after-free vulnerability in tcpreplay's tcprewrite component allows local attackers to potentially crash the application or execute arbitrary code. This affects tcpreplay versions up to 4.5.1 when processing IPv6 packets. Only users who run tcprewrite locally on vulnerable systems are affected.
💻 Affected Systems
- appneta tcpreplay
📦 What is this software?
Tcpreplay by Broadcom
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to arbitrary code execution as the user running tcprewrite, potentially compromising the entire system.
Likely Case
Application crash (denial of service) when processing malicious IPv6 packets with tcprewrite.
If Mitigated
No impact if tcprewrite is not used or if proper access controls prevent local users from executing it.
🎯 Exploit Status
Exploit details have been published in references. Requires local access and ability to run tcprewrite with crafted IPv6 packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.2-beta3 or later
Vendor Advisory: https://github.com/appneta/tcpreplay/issues/972
Restart Required: No
Instructions:
1. Check current version with 'tcpreplay --version'. 2. Upgrade to 4.5.2-beta3 or later using package manager or source compilation. 3. Verify fix with 'tcprewrite --version' showing patched version.
🔧 Temporary Workarounds
Disable tcprewrite usage
allRemove execute permissions or restrict access to tcprewrite binary
chmod -x /usr/bin/tcprewrite
chmod 700 /usr/bin/tcprewrite
Avoid IPv6 packet processing
allConfigure workflows to avoid processing IPv6 packets with tcprewrite
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from executing tcprewrite
- Monitor for crash logs or unexpected behavior in tcprewrite processes
🔍 How to Verify
Check if Vulnerable:
Run 'tcprewrite --version' and check if version is 4.5.1 or earlierCheck Version:
tcprewrite --versionVerify Fix Applied:
Confirm version is 4.5.2-beta3 or later with 'tcprewrite --version'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from tcprewrite process
- Unexpected termination of tcprewrite
Network Indicators:
- None - local exploit only
SIEM Query:
process.name:tcprewrite AND (event.type:crash OR exit_code:139)