Skip to content

v4.6.0-beta3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@fklassen fklassen released this 24 Jul 16:30
v4.6.0-beta3
This tag was signed with the committer’s verified signature.
fklassen Fred Klassen
GPG key ID: E9E2149793BDE17E
Verified
Learn about vigilant mode.
e6e32ec

Announcing Tcpreplay v4.6.0-beta3. This release fixes three memory-safety issues reported against 4.5.5, all present in v4.6.0-beta2 and earlier, plus a cosmetic test-output fix.

Each of the three is reached from a local file processed with documented CLI options and needs no elevated privileges. Published security advisories are linked below; CVE identifiers have been requested and will be added once assigned.

Security

  • SECURITY: fix stack buffer overflow in the tcpprep --services file parser (GHSA-fwcr-mqg6-hqmx, CWE-121). parse_services() (src/common/services.c) copied the regex-matched port substring into a 10-byte stack buffer with strncpy() using the match length as the count; the ([0-9]+) group is unbounded, so a services file with an overlong digit run before /tcp overflowed the buffer. Each copy is now clamped to its destination size. Reported by tinyb0y.
  • SECURITY: fix heap out-of-bounds access in ARP address rewriting (GHSA-5q26-7fxx-v8fh, CWE-787). rewrite_iparp()/randomize_iparp() (src/tcpedit/edit_packet.c) computed the sender/target IP field offsets from the packet's own ar_hln/ar_pln bytes (attacker-controlled, 0–255) after checking only that the 8-byte ARP base header was present. A crafted ARP packet reached up to ~773 bytes past the header; via tcpreplay/tcpreplay-edit --preload-pcap (whose cache buffer is only caplen+512) this is an out-of-bounds read and 4-byte write. Both functions now require ar_pln == 4 and the full IPv4 ARP payload to fit within the captured L3 length before dereferencing. Reported by tinyb0y.
  • SECURITY: fix heap out-of-bounds read via --pktlen with --preload-pcap (GHSA-m6w7-8497-g9c9, CWE-125). send_packets() (src/send_packets.c) sized the packet cache buffer from caplen but, under --pktlen, sent pkthdr.len bytes — the on-the-wire length, which for a truncated capture can exceed caplen (up to MAX_SNAPLEN, 256KB), reading and transmitting adjacent heap memory. The send length is now clamped to caplen at every send site. Reported by tinyb0y.

Note: the fixes ship in this 4.6.0 beta; the 4.5.x stable line is not patched for these three issues.

Other changes

  • test: align the OK/FAILED status column for the three fragroute test targets so the whole suite lines up on screen.

Verifying the download

The .tar.gz/.tar.xz tarballs are accompanied by detached PGP signatures (.asc), signed with the tcpreplay release key (tcpreplay@appneta.com, fingerprint 84E4FA215C934A7D97DC76D5E9E2149793BDE17E):

gpg --verify tcpreplay-4.6.0_beta3.tar.xz.asc tcpreplay-4.6.0_beta3.tar.xz

Full Changelog: v4.6.0-beta2...v4.6.0-beta3

Download the release by clicking the tcpreplay* assets below ...

Assets 6
Loading