CVE-2022-0582: Wireshark CSN.1 Protocol DOS Vulnerability

CVE-2022-0582 Overview

CVE-2022-0582 is a Null Pointer Dereference vulnerability affecting the CSN.1 protocol dissector in Wireshark, a widely-used network protocol analyzer. The vulnerability stems from unaligned memory access in the CSN.1 dissector component, which can be triggered through packet injection or by processing a crafted capture file. Successful exploitation allows remote attackers to cause a denial of service condition, disrupting network analysis operations and potentially impacting security monitoring capabilities.

Critical Impact

Remote attackers can crash Wireshark instances through malicious network packets or capture files, disrupting network forensics and security monitoring operations without requiring authentication.

Affected Products

• Wireshark versions 3.6.0 to 3.6.1
• Wireshark versions 3.4.0 to 3.4.11
• Fedora 34 and Fedora 35 (via included Wireshark packages)
• Debian Linux 9.0 (via included Wireshark packages)

Discovery Timeline

• 2022-02-14 - CVE-2022-0582 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2022-0582

Vulnerability Analysis

This vulnerability exists within Wireshark's CSN.1 (Concrete Syntax Notation One) protocol dissector, which is responsible for parsing and displaying CSN.1 encoded data structures commonly found in mobile telecommunications protocols such as GSM, GPRS, and UMTS. The CSN.1 dissector improperly handles memory alignment when processing certain protocol data units, leading to unaligned memory access operations.

When the dissector encounters malformed or specially crafted data, it attempts to read memory at addresses that are not properly aligned for the expected data type. On architectures that enforce strict memory alignment requirements, this results in a hardware exception that terminates the process. Even on architectures with more relaxed alignment handling, the unaligned access can trigger internal error handling that leads to a null pointer dereference condition (CWE-476), crashing the application.

The network-based attack vector allows remote exploitation without any user authentication or privileges. An attacker can inject malicious packets onto a network being monitored by Wireshark, or distribute a crafted PCAP capture file that triggers the vulnerability when opened by an analyst.

Root Cause

The root cause is improper handling of memory alignment in the CSN.1 protocol dissector code. The dissector fails to properly validate and align memory pointers before performing read operations on protocol data structures. This results in unaligned memory access that can cause process termination or lead to a null pointer dereference when error handling paths are triggered.

Attack Vector

The vulnerability can be exploited through two primary attack vectors:

1. Packet Injection: An attacker on the same network segment can inject specially crafted packets containing malformed CSN.1 data. When Wireshark captures and attempts to dissect these packets, the vulnerability is triggered.

2. Malicious Capture Files: An attacker can distribute crafted PCAP or PCAPNG files containing the exploit payload. When a user opens the file in Wireshark for analysis, the CSN.1 dissector processes the malicious data and crashes.

The attack requires no authentication or user interaction beyond normal network capture or file opening operations. For detailed technical information, refer to the Wireshark Issue #17882 on GitLab.

Detection Methods for CVE-2022-0582

Indicators of Compromise

• Repeated unexpected crashes of Wireshark processes during packet capture or file analysis
• Wireshark crash dumps indicating faults in CSN.1 dissector code paths
• Presence of PCAP files with anomalous CSN.1 protocol data structures
• Unusual network traffic containing malformed GSM/GPRS/UMTS protocol elements

Detection Strategies

• Monitor for Wireshark process terminations with exit codes indicating memory access violations or segmentation faults
• Implement file integrity monitoring on capture file directories to detect introduction of potentially malicious PCAP files
• Deploy network intrusion detection rules to identify packets with malformed CSN.1 encoding patterns
• Audit Wireshark version deployments across the organization to identify vulnerable installations

Monitoring Recommendations

• Configure centralized logging for Wireshark crash events and core dumps
• Implement application crash monitoring for all network analysis workstations
• Monitor for unusual patterns in capture file distribution or sharing
• Track Wireshark version compliance across security operations teams

How to Mitigate CVE-2022-0582

Immediate Actions Required

• Upgrade Wireshark to version 3.6.2 or later for the 3.6.x branch
• Upgrade Wireshark to version 3.4.12 or later for the 3.4.x branch
• Apply available security patches from Fedora and Debian repositories for affected Linux distributions
• Review and apply security advisories from Wireshark Security Advisory 2022-04

Patch Information

Wireshark has released patched versions addressing this vulnerability. Organizations should update to the following minimum versions:

• Wireshark 3.6.x series: Update to version 3.6.2 or later
• Wireshark 3.4.x series: Update to version 3.4.12 or later

Linux distribution users should apply updates through their package managers:

• Fedora users: Apply updates per the Fedora Package Announcements
• Debian users: Apply updates per the Debian LTS Security Advisory
• Gentoo users: Apply updates per Gentoo GLSA 2022-10-04

Workarounds

• Disable the CSN.1 protocol dissector if not required for analysis tasks using Wireshark's protocol preferences
• Avoid opening capture files from untrusted sources until patches are applied
• Run Wireshark with restricted privileges to limit the impact of potential crashes
• Isolate network analysis workstations from untrusted network segments during capture operations

# Disable CSN.1 dissector via command line
wireshark -o "csn1.enabled:FALSE"

# Alternative: Edit preferences file to disable dissector
echo "csn1.enabled: FALSE" >> ~/.config/wireshark/preferences