CVE-2024-2397: 
TCPdump vulnerability analysis and mitigation

CVE-2024-2397 is a vulnerability discovered in tcpdump's PPP printer functionality. The issue was identified in the git master branch between June 5, 2023, and March 21, 2024, affecting the packet data buffers management system. Importantly, this vulnerability does not affect any official tcpdump releases (NVD).

The vulnerability stems from a bug in packet data buffers management where the PPP printer can enter an infinite loop when processing a specially crafted DLT_PPP_SERIAL .pcap savefile. The issue has been assigned a CVSS v3.1 base score of 6.2 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition) (NVD).

The vulnerability can lead to a denial of service condition through an infinite loop when processing specially crafted .pcap files. This affects the availability of the system processing the malicious file (Fedora).

The vulnerability requires local access to exploit and involves processing a specially crafted DLT_PPP_SERIAL .pcap savefile. The attack complexity is low, and no privileges or user interaction are required to execute the exploit (NVD).

The issue has been fixed in the tcpdump git repository through commit b9811ef. The fix involves using the buffer stack for the de-escaping buffer and properly restoring packet processing values even when exceptions occur. Users should update to versions containing this fix (Github).

Multiple Linux distributions have responded to this vulnerability by releasing security updates, including Fedora 39 and 40, which have issued patches to address the vulnerability (Fedora-39, Fedora-40).