Announcing Tcpreplay v4.6.0-beta2. This update is primarily a security release. It carries every fix from v4.5.4 and v4.5.5 onto the 4.6 line, plus two more found while auditing them.
v4.6.0-beta1 is affected by all eleven advisories below and should not be used.
Security
These are all reached from tcprewrite --fragroute=<rules-file> with an attacker-influenced rules file, except get_layer4_v6, which is reached by reading an untrusted pcap with any of the tools.
| advisory | issue |
|---|---|
| GHSA-777w-9599-w8g4 | Stack buffer overflow in the fragroute rules-file parser — mod_open() built a rule-list diagnostic in an 8192-byte local and sprintf()'d it into the caller's 1024-byte errbuf. Reported by tinyb0y.
|
| GHSA-p7xp-4gj2-x56c | Out-of-bounds write on an empty rules file — the same code trimmed with buf[strlen(buf) - 4], underflowing size_t when a file parsed cleanly but yielded no rules.
|
| GHSA-m655-53p4-6qm8 | Off-by-one heap overflow in ip_chaff — rand_strset() called with one byte more than the duplicate owns. Reported by tinyb0y.
|
| GHSA-v8c4-9w98-9v6v | The identical off-by-one in tcp_chaff, a module the ip_chaff advisory did not cover.
|
| GHSA-27v4-xhfx-g2rx | Heap overflow via negative fragment/segment size in ip_frag/tcp_seg — -8 % 8 == 0 passed the multiple-of-8 test and reached memcpy() as a huge size_t. Reported by tinyb0y.
|
| GHSA-jj65-mrgg-f5fx | Heap over-read in get_layer4_v6() walking IPv6 extension headers. Reported by msxfXF in 2024 and marked patched, but the proof-of-concept still reproduced until now.
|
| GHSA-pfqg-243f-8q25 | Heap overflow in the fragroute tcp_opt module. Reported by tinyb0y.
|
| GHSA-2wmf-4p77-784q | Heap overflow in the fragroute ip6_opt module. Reported by tinyb0y.
|
| GHSA-pjh6-6hrw-vcwr | Buffer overflow in the KHIAL sendpacket() path. Reported by 360AlphaLab.
|
| GHSA-ww62-mxv7-pg55 | SEGV in the tcpedit DLT_JUNIPER_ETHER plugin when used as a decoder. Reported and originally patched by jiezhuzzz.
|
| GHSA-5cjx-62pj-pmgq | NULL dereference in remove_settings() on a failed text_mmap (already fixed on this line by the #931 rewrite in beta1).
|
Also hardened: pkt_dup() no longer leaves the duplicate's pkt_buf_size uninitialized or free the source packet on OOM; six pkt_new()/pkt_dup() call sites now check for failure; mod_open() no longer frees a rule still linked into the rule list.
Other changes since beta1
- common: fix pthread_attr leak and add explicit ring teardown in txring (#1061), found by @Solaris-star
- scripts/autoopts: fix a stray literal
+leaking into the man page DESCRIPTION - def: fix unclosed
@tableblocks and bare@itemlists in man page doc text - test: add fragroute test cases — the fragroute tree previously had no coverage at all, which is how these bugs went unnoticed
- build: ignore the configure-generated
src/libtcpreplay.pc
Full Changelog: v4.6.0-beta1...v4.6.0-beta2
Download the release by clicking the tcpreplay* assets below ...