CVE-2024-0208: Wireshark GVCP Dissector DoS Vulnerability

CVE-2024-0208 Overview

CVE-2024-0208 is a denial of service vulnerability affecting the GVCP (GigE Vision Control Protocol) dissector in Wireshark, the widely-used network protocol analyzer. The vulnerability allows attackers to crash Wireshark through packet injection or by tricking a user into opening a maliciously crafted capture file. This flaw impacts multiple versions across the 3.6.x, 4.0.x, and 4.2.x release branches.

Critical Impact

Successful exploitation causes Wireshark to crash, disrupting network analysis workflows and potentially enabling follow-on attacks while defenders are blind to network traffic.

Affected Products

• Wireshark 4.2.0
• Wireshark 4.0.0 to 4.0.11
• Wireshark 3.6.0 to 3.6.19

Discovery Timeline

• 2024-01-03 - CVE-2024-0208 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-0208

Vulnerability Analysis

This vulnerability resides in the GVCP dissector component of Wireshark, which is responsible for parsing GigE Vision Control Protocol packets commonly used in industrial imaging and machine vision applications. The flaw is classified under CWE-230 (Improper Handling of Missing Values), indicating that the dissector fails to properly handle certain missing or malformed data fields within GVCP packets.

When Wireshark encounters a specially crafted GVCP packet—either captured live on the network or loaded from a pcap file—the dissector enters an invalid state that leads to an application crash. The network-based attack vector with no required authentication or user interaction makes this vulnerability particularly concerning in environments where Wireshark is used for continuous network monitoring.

Root Cause

The root cause stems from improper handling of missing values (CWE-230) within the GVCP dissector logic. The dissector does not adequately validate or handle edge cases where expected protocol fields are absent or contain unexpected values, leading to a crash condition. This type of flaw commonly occurs when protocol parsers assume well-formed input and lack defensive checks for malformed data.

Attack Vector

An attacker can exploit this vulnerability through two primary methods:

1. Network Packet Injection: An attacker on the same network segment can inject malicious GVCP packets that will be captured and processed by Wireshark, triggering the crash when the dissector attempts to parse them.

2. Malicious Capture File: An attacker can distribute a crafted pcap/pcapng file containing malicious GVCP packets. When a user opens this file in Wireshark, the application crashes.

The vulnerability allows for exploitation without authentication and requires no user interaction beyond normal Wireshark operation. The dissector processes packets automatically, meaning any GVCP traffic—legitimate or malicious—will be parsed and potentially trigger the flaw.

Detection Methods for CVE-2024-0208

Indicators of Compromise

• Unexpected Wireshark crashes during network capture sessions, particularly when GVCP traffic is present
• Core dump files or crash reports indicating failures within the GVCP dissector module
• Unusual GVCP traffic patterns originating from suspicious sources on the network
• Receipt of unsolicited pcap files containing GVCP protocol data

Detection Strategies

• Monitor for repeated Wireshark process terminations and automatic restarts in network monitoring systems
• Implement network intrusion detection rules to identify anomalous GVCP traffic patterns
• Review system logs for Wireshark crash events correlated with network capture activity
• Use endpoint detection and response (EDR) solutions to track process crashes and identify potential exploitation attempts

Monitoring Recommendations

• Enable Wireshark crash logging and forward logs to a centralized SIEM for analysis
• Deploy network sensors to baseline normal GVCP traffic and alert on deviations
• Monitor file system activity for suspicious pcap files being introduced to analyst workstations
• Implement application health monitoring for Wireshark processes in SOC environments

How to Mitigate CVE-2024-0208

Immediate Actions Required

• Upgrade Wireshark to version 4.2.1, 4.0.12, or 3.6.20 or later immediately
• Disable the GVCP dissector if not required for analysis workflows until patching is complete
• Avoid opening untrusted capture files from unknown or unverified sources
• Consider isolating network capture systems to limit exposure to malicious packet injection

Patch Information

Wireshark has released security updates addressing this vulnerability. Users should upgrade to the following fixed versions:

• Wireshark 4.2.1 or later for the 4.2.x branch
• Wireshark 4.0.12 or later for the 4.0.x branch
• Wireshark 3.6.20 or later for the 3.6.x branch

Detailed patch information is available in the Wireshark Security Advisory 2024-01 and the GitLab Issue #19496. Linux distribution users should also check their package managers for updated packages; advisories have been issued for Debian LTS and Fedora.

Workarounds

• Disable the GVCP protocol dissector via Edit → Preferences → Protocols → GVCP and uncheck "Enable GVCP dissector"
• Use TShark with display filters to exclude GVCP traffic during capture sessions
• Apply network ACLs to filter GVCP traffic (UDP port 3956) at network boundaries if not required
• Use sandboxed or isolated environments when analyzing untrusted capture files

# Disable GVCP dissector via command line
wireshark -o "gvcp.enable:FALSE"

# Alternative: Use TShark with GVCP disabled
tshark -o "gvcp.enable:FALSE" -i eth0

# Filter out GVCP traffic during capture
tshark -i eth0 -f "not udp port 3956"