CVE-2024-0208: Wireshark GVCP Dissector DoS Vulnerability

CVE-2024-0208 Overview

CVE-2024-0208 is a denial of service vulnerability affecting the GVCP (GigE Vision Control Protocol) dissector in Wireshark, the widely-used network protocol analyzer. The vulnerability allows attackers to crash Wireshark through packet injection or by tricking a user into opening a maliciously crafted capture file. This flaw impacts multiple versions across the 3.6.x, 4.0.x, and 4.2.x release branches.

Critical Impact
Successful exploitation causes Wireshark to crash, disrupting network analysis workflows and potentially enabling follow-on attacks while defenders are blind to network traffic.

Affected Products

Wireshark 4.2.0
Wireshark 4.0.0 to 4.0.11
Wireshark 3.6.0 to 3.6.19

Discovery Timeline

2024-01-03 - CVE-2024-0208 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-0208

Vulnerability Analysis

This vulnerability resides in the GVCP dissector component of Wireshark, which is responsible for parsing GigE Vision Control Protocol packets commonly used in industrial imaging and machine vision applications. The flaw is classified under CWE-230 (Improper Handling of Missing Values), indicating that the dissector fails to properly handle certain missing or malformed data fields within GVCP packets.

When Wireshark encounters a specially crafted GVCP packet—either captured live on the network or loaded from a pcap file—the dissector enters an invalid state that leads to an application crash. The network-based attack vector with no required authentication or user interaction makes this vulnerability particularly concerning in environments where Wireshark is used for continuous network monitoring.

Root Cause

The root cause stems from improper handling of missing values (CWE-230) within the GVCP dissector logic. The dissector does not adequately validate or handle edge cases where expected protocol fields are absent or contain unexpected values, leading to a crash condition. This type of flaw commonly occurs when protocol parsers assume well-formed input and lack defensive checks for malformed data.

Attack Vector

An attacker can exploit this vulnerability through two primary methods:

Network Packet Injection: An attacker on the same network segment can inject malicious GVCP packets that will be captured and processed by Wireshark, triggering the crash when the dissector attempts to parse them.
Malicious Capture File: An attacker can distribute a crafted pcap/pcapng file containing malicious GVCP packets. When a user opens this file in Wireshark, the application crashes.

The vulnerability allows for exploitation without authentication and requires no user interaction beyond normal Wireshark operation. The dissector processes packets automatically, meaning any GVCP traffic—legitimate or malicious—will be parsed and potentially trigger the flaw.

Detection Methods for CVE-2024-0208

Indicators of Compromise

Unexpected Wireshark crashes during network capture sessions, particularly when GVCP traffic is present
Core dump files or crash reports indicating failures within the GVCP dissector module
Unusual GVCP traffic patterns originating from suspicious sources on the network
Receipt of unsolicited pcap files containing GVCP protocol data

Detection Strategies

Monitor for repeated Wireshark process terminations and automatic restarts in network monitoring systems
Implement network intrusion detection rules to identify anomalous GVCP traffic patterns
Review system logs for Wireshark crash events correlated with network capture activity
Use endpoint detection and response (EDR) solutions to track process crashes and identify potential exploitation attempts

Monitoring Recommendations

Enable Wireshark crash logging and forward logs to a centralized SIEM for analysis
Deploy network sensors to baseline normal GVCP traffic and alert on deviations
Monitor file system activity for suspicious pcap files being introduced to analyst workstations
Implement application health monitoring for Wireshark processes in SOC environments

How to Mitigate CVE-2024-0208

Immediate Actions Required

Upgrade Wireshark to version 4.2.1, 4.0.12, or 3.6.20 or later immediately
Disable the GVCP dissector if not required for analysis workflows until patching is complete
Avoid opening untrusted capture files from unknown or unverified sources
Consider isolating network capture systems to limit exposure to malicious packet injection

Patch Information

Wireshark has released security updates addressing this vulnerability. Users should upgrade to the following fixed versions:

Wireshark 4.2.1 or later for the 4.2.x branch
Wireshark 4.0.12 or later for the 4.0.x branch
Wireshark 3.6.20 or later for the 3.6.x branch

Detailed patch information is available in the Wireshark Security Advisory 2024-01 and the GitLab Issue #19496. Linux distribution users should also check their package managers for updated packages; advisories have been issued for Debian LTS and Fedora.

Workarounds

Disable the GVCP protocol dissector via Edit → Preferences → Protocols → GVCP and uncheck "Enable GVCP dissector"
Use TShark with display filters to exclude GVCP traffic during capture sessions
Apply network ACLs to filter GVCP traffic (UDP port 3956) at network boundaries if not required
Use sandboxed or isolated environments when analyzing untrusted capture files

bash

# Disable GVCP dissector via command line
wireshark -o "gvcp.enable:FALSE"

# Alternative: Use TShark with GVCP disabled
tshark -o "gvcp.enable:FALSE" -i eth0

# Filter out GVCP traffic during capture
tshark -i eth0 -f "not udp port 3956"