CVE-2020-12740: 
NixOS vulnerability analysis and mitigation

A heap-based buffer over-read vulnerability (CVE-2020-12740) was discovered in tcprewrite, a component of Tcpreplay through version 4.3.2. The vulnerability was identified in May 2020 and affects the get_c operation during IPv6 packet processing (Debian Tracker, Ubuntu Notice).

The vulnerability exists in the get_ipv6_next() function located in common/get.c. The issue occurs when processing IPv6 packets, specifically during the get_c operation where a heap-based buffer over-read is triggered. The vulnerability was discovered through testing with Address Sanitizer (ASAN) which revealed the buffer overflow when processing specially crafted packet capture input (GitHub Issue).

When exploited, this vulnerability can lead to a Denial of Service (DoS) condition and potentially expose sensitive information when the application attempts to process maliciously crafted files. The impact is primarily limited to scenarios where tcprewrite processes untrusted packet capture files (GitHub Issue).

The vulnerability can be triggered by submitting a malicious pcap file to tcprewrite with specific command parameters. A proof of concept exists that demonstrates the exploitation using the command 'tcprewrite -i $poc -o /dev/null --fuzz-seed=42' (GitHub Issue).

The vulnerability was fixed in Tcpreplay version 4.3.3. Users are advised to upgrade to this version or later. The fix was included in various distribution updates, including Debian Bullseye (4.3.3-2), Ubuntu, and Fedora (Debian Tracker, Fedora Update).