CVE-2024-0209 Overview
CVE-2024-0209 is a denial-of-service vulnerability in the IEEE 1609.2 dissector of Wireshark. The flaw affects Wireshark 4.2.0, versions 4.0.0 through 4.0.11, and versions 3.6.0 through 3.6.19. Attackers can trigger a crash by injecting a crafted packet onto a monitored network or by tricking an analyst into opening a malicious capture file. The underlying weakness is a NULL pointer dereference [CWE-476] in the protocol dissector. Exploitation requires no authentication or user interaction when the attacker has network adjacency to a live capture session. The Wireshark Foundation addressed the issue in advisory wnpa-sec-2024-02.
Critical Impact
Remote attackers can crash Wireshark instances through packet injection or crafted capture files, disrupting network forensics and incident response workflows.
Affected Products
- Wireshark 4.2.0
- Wireshark 4.0.0 through 4.0.11
- Wireshark 3.6.0 through 3.6.19
Discovery Timeline
- 2024-01-03 - CVE-2024-0209 published to NVD
- 2024-01-03 - Wireshark Security Advisory wnpa-sec-2024-02 released
- 2024-09 - Debian LTS advisory issued for backported fixes
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0209
Vulnerability Analysis
The vulnerability resides in the IEEE 1609.2 dissector, which parses Wireless Access in Vehicular Environments (WAVE) security messages used in connected-vehicle communications. When the dissector processes specifically malformed IEEE 1609.2 data, it dereferences a pointer that was never initialized to a valid object. The process terminates immediately, ending the active capture and any in-progress analysis. Because Wireshark applies dissectors automatically as packets arrive or as capture files are loaded, an attacker does not need to convince the user to take an explicit action beyond opening the file or running a live capture.
Root Cause
The defect is classified as CWE-476: NULL Pointer Dereference. The IEEE 1609.2 dissector assumes that a parsed sub-structure is always present and accesses fields without validating that the prerequisite parsing step returned a non-null result. Crafted input that omits or corrupts the expected sub-structure causes the dissector to follow a NULL pointer, terminating the Wireshark process.
Attack Vector
Attackers have two practical delivery paths. The first is packet injection on a network segment that an analyst is actively capturing, allowing the malicious frame to reach the dissector in real time. The second is social-engineering delivery of a .pcap or .pcapng capture file that contains the malformed IEEE 1609.2 payload. Both paths require no credentials and no user interaction beyond standard analyst workflow. Refer to the Wireshark Security Advisory WNPA-SEC-2024-02 and GitLab Wireshark Issue #19501 for protocol-level technical details.
Detection Methods for CVE-2024-0209
Indicators of Compromise
- Unexpected termination of wireshark, tshark, or dumpcap processes during live capture or file analysis.
- Capture files containing IEEE 1609.2 frames received from untrusted or unexpected sources.
- Repeated crash reports from analyst workstations correlated with specific .pcap or .pcapng files.
Detection Strategies
- Inventory endpoints running vulnerable Wireshark builds (3.6.0–3.6.19, 4.0.0–4.0.11, 4.2.0) using software asset management or EDR telemetry.
- Alert on abnormal exit codes or crash dumps from Wireshark processes via endpoint logs and OS crash reporters.
- Inspect inbound capture files shared via email or collaboration platforms for IEEE 1609.2 protocol markers when senders are not trusted.
Monitoring Recommendations
- Forward Wireshark process termination events and Windows Error Reporting or Linux core_pattern artifacts to centralized log analytics.
- Track installation and update events for Wireshark packages to confirm vulnerable versions have been removed.
- Monitor analyst workstations for repeated short-lived tshark sessions that may indicate exploitation attempts during automated capture processing.
How to Mitigate CVE-2024-0209
Immediate Actions Required
- Upgrade Wireshark to a patched release: 4.2.1, 4.0.12, or 3.6.20 or later.
- Avoid opening capture files from untrusted sources on hosts still running vulnerable Wireshark builds.
- Disable live capture on shared or exposed network segments until the upgrade is completed.
Patch Information
The Wireshark Foundation released fixed builds alongside advisory wnpa-sec-2024-02. Debian LTS users should apply updates from the Debian LTS Announcement September 2024. Full remediation details are available in GitLab Wireshark Issue #19501.
Workarounds
- Disable the IEEE 1609.2 dissector in Analyze → Enabled Protocols if upgrading is not immediately possible.
- Use tshark with --disable-protocol ieee1609dot2 when processing capture files from untrusted sources.
- Restrict analyst workstations to offline capture review with read-only file shares to reduce live-injection exposure.
# Disable the vulnerable dissector when running tshark
tshark --disable-protocol ieee1609dot2 -r suspicious_capture.pcapng
# Verify installed Wireshark version is patched
wireshark --version | head -n 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
