CVE-2020-24266: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability (CVE-2020-24266) was discovered in tcpreplay tcpprep version 4.3.3, specifically in the get_l2len() function. The vulnerability was discovered in July 2020 and affects the tcpprep component of the tcpreplay suite, which is a tool used to replay captured network traffic (NVD, GitHub Issue).

The vulnerability is classified as a heap buffer overflow in the get_l2len() function of tcpprep. It has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is categorized under CWE-787 (Out-of-bounds Write) (NVD).

When exploited, this vulnerability can cause tcpprep to crash, resulting in a denial of service condition. The vulnerability affects the application's stability and availability, though there are no reported impacts on confidentiality or integrity (NVD, Gentoo Security).

The vulnerability can be triggered by processing specially crafted packet capture input through the tcpprep utility. An attacker could exploit this by enticing a user to open a maliciously crafted network capture file (GitHub Issue, Gentoo Security).

The vulnerability has been fixed in tcpreplay version 4.3.4. Users are advised to upgrade to this version or later. Various Linux distributions have released security updates to address this vulnerability, including Fedora and Gentoo (Fedora Update, Gentoo Security).