CVE-2023-6174: Wireshark SSH Dissector DOS Vulnerability

CVE-2023-6174 Overview

CVE-2023-6174 is a denial of service vulnerability in the Secure Shell (SSH) protocol dissector of Wireshark versions 4.0.0 through 4.0.10. An attacker can crash the application by injecting malicious packets onto a network being analyzed or by tricking a user into opening a crafted capture file. The flaw is tracked under Wireshark security advisory wnpa-sec-2023-28 and is associated with [CWE-125] (out-of-bounds read) and [CWE-74] (improper input neutralization). Linux distributions including Debian, Fedora, and Gentoo have published downstream advisories.

Critical Impact
Successful exploitation crashes the Wireshark process, disrupting packet capture, network forensics, and incident response workflows that rely on the tool.

Affected Products

Wireshark 4.0.0 through 4.0.10
Debian Linux 12.0 (wireshark package)
Fedora and Gentoo distributions shipping affected wireshark builds

Discovery Timeline

2023-11-16 - CVE-2023-6174 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-6174

Vulnerability Analysis

The vulnerability lives in the SSH dissector that Wireshark uses to parse SSH protocol traffic during live capture or when reading saved capture files. When the dissector encounters specifically malformed SSH packet structures, it performs an out-of-bounds read that aborts the process. The bug is reachable in both live capture mode and offline analysis of .pcap and .pcapng files. Because Wireshark dissectors execute automatically on every packet that matches their protocol heuristics, no user action beyond opening a file or viewing live traffic is required.

Root Cause

The root cause is improper validation of input within the SSH dissector code path. The dissector trusts length or field values inside SSH packets and reads beyond the bounds of the underlying buffer when those values are crafted maliciously. This combination of [CWE-125] and [CWE-74] results in a process-terminating crash rather than memory corruption suitable for code execution. Full technical details are tracked in the Wireshark GitLab issue 19369.

Attack Vector

There are two practical attack paths. First, an attacker on the same network segment as an analyst can inject crafted SSH packets that Wireshark will dissect during live capture. Second, an attacker can deliver a malicious .pcap or .pcapng file through email, chat, or a shared analysis platform; the file crashes Wireshark when opened. The second vector is the more common scenario in incident response and threat-hunting workflows where capture files are routinely shared. No verified public proof-of-concept exploit is currently available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the Wireshark Security Advisory wnpa-sec-2023-28 for the official technical write-up.

Detection Methods for CVE-2023-6174

Indicators of Compromise

Unexpected crashes of the wireshark or tshark process while parsing SSH traffic or opening capture files
Receipt of unsolicited .pcap or .pcapng files from external or untrusted sources
Core dump files generated by Wireshark on analyst workstations running versions 4.0.0 through 4.0.10

Detection Strategies

Inventory all analyst workstations and forensic VMs to identify Wireshark builds in the affected version range
Monitor process termination events for wireshark.exe, wireshark, and tshark followed by user-initiated restarts
Inspect SSH packets at network egress for malformed length fields that deviate from RFC 4253 framing

Monitoring Recommendations

Log file-open operations for capture files on shared analysis systems and correlate with subsequent process crashes
Track installation and update events for the Wireshark package across Windows, macOS, and Linux endpoints
Subscribe to Wireshark security advisories and downstream distribution feeds (Debian DSA, Fedora, Gentoo GLSA)

How to Mitigate CVE-2023-6174

Immediate Actions Required

Upgrade Wireshark to version 4.0.11 or later, or to the 4.2.x branch where the SSH dissector fix is included
Apply distribution updates: Debian DSA-5559, Gentoo GLSA 202402-09, and the corresponding Fedora package announcements
Restrict opening of capture files to those received from trusted sources and verified through hash validation

Patch Information

The Wireshark Foundation released fixed builds following advisory wnpa-sec-2023-28. Users on the 4.0.x branch should upgrade to 4.0.11 or later. Downstream Linux distributions have shipped patched packages: Debian via DSA-5559, Gentoo via GLSA 202402-09, and Fedora via package announcements 34DBP5P2RHQ7XUABPANYYMOGV5KS6VEP and MADSCHKZSCKQ5NLIX3UMOIJD2JZ65L4V.

Workarounds

Disable the SSH dissector in Analyze → Enabled Protocols until patched builds can be deployed
Use tshark with an explicit -d decode-as directive that avoids the SSH dissector when analyzing untrusted captures
Open suspicious capture files inside an isolated virtual machine or sandbox to contain crashes and any future related issues

bash

# Disable the SSH dissector from the command line by overriding the protocol preference
tshark -o 'ssh.desegment_ssh_buffers:FALSE' --disable-protocol ssh -r untrusted.pcapng

# Verify the installed Wireshark version on Debian-based systems
dpkg -l wireshark | awk '/^ii/ {print $3}'

# Upgrade on Debian 12
sudo apt-get update && sudo apt-get install --only-upgrade wireshark tshark