CVE-2024-11595: Wireshark FiveCo RAP DoS Vulnerability

CVE-2024-11595 Overview

CVE-2024-11595 is an infinite loop vulnerability affecting the FiveCo RAP dissector in Wireshark, the widely-used network protocol analyzer. This flaw enables attackers to cause a denial of service (DoS) condition by injecting malicious packets or by tricking a user into opening a specially crafted capture file. When triggered, the vulnerable dissector enters an infinite loop, causing Wireshark to become unresponsive and consume excessive system resources.

Critical Impact

Exploitation of this vulnerability allows attackers to disrupt network analysis operations by causing Wireshark to hang indefinitely, potentially impacting security monitoring and incident response activities.

Affected Products

• Wireshark versions 4.4.0 to 4.4.1
• Wireshark versions 4.2.0 to 4.2.8

Discovery Timeline

• 2024-11-21 - CVE-2024-11595 published to NVD
• 2025-05-07 - Last updated in NVD database

Technical Details for CVE-2024-11595

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The FiveCo RAP (Remote Access Protocol) dissector in Wireshark fails to properly validate input data when parsing certain protocol fields, leading to a condition where the parsing loop never terminates.

The attack requires local access, meaning an attacker must either inject packets on a network being monitored by the victim or convince the victim to open a malicious capture file (such as a .pcap or .pcapng file). User interaction is required for exploitation via crafted capture files. The vulnerability impacts system availability without affecting confidentiality or integrity of data.

Root Cause

The root cause is an infinite loop condition (CWE-835) in the FiveCo RAP protocol dissector. The dissector fails to properly handle malformed or specially crafted protocol data, resulting in a loop that lacks a reachable exit condition. This occurs when parsing specific fields within the FiveCo RAP protocol structure where boundary conditions are not adequately checked.

Attack Vector

The vulnerability can be exploited through two primary attack vectors:

1. Packet Injection: An attacker with access to a network segment being captured by Wireshark can inject malicious FiveCo RAP packets that trigger the infinite loop when Wireshark processes them in real-time.

2. Crafted Capture File: An attacker can create a malicious packet capture file containing the exploit payload and distribute it to victims. When the victim opens the file in Wireshark, the application enters an infinite loop and becomes unresponsive.

The exploitation mechanism targets the dissector's parsing logic. When Wireshark encounters a FiveCo RAP packet with specific malformed data, the dissector enters a loop that continuously processes the same data without advancing to the next packet or terminating, effectively freezing the application. For detailed technical information, refer to the GitLab Wireshark Issue #20176.

Detection Methods for CVE-2024-11595

Indicators of Compromise

• Wireshark process consuming unusually high CPU resources (approaching 100% on a single core)
• Wireshark application becoming unresponsive when processing network traffic or opening capture files
• Presence of FiveCo RAP protocol packets in network captures from untrusted sources
• System logs indicating application hangs or forced terminations of Wireshark processes

Detection Strategies

• Monitor for Wireshark processes exhibiting abnormal CPU utilization patterns that may indicate an infinite loop condition
• Implement file integrity monitoring on capture files received from external sources before opening in Wireshark
• Deploy network traffic analysis to identify anomalous FiveCo RAP protocol traffic that could be attempting exploitation
• Configure application monitoring to detect and alert on Wireshark process hangs or crashes

Monitoring Recommendations

• Enable process monitoring for Wireshark instances to detect CPU spikes exceeding normal operational thresholds
• Implement logging for Wireshark crashes and force-quits to identify potential exploitation attempts
• Review capture files from untrusted sources in isolated environments before analysis on production systems
• Monitor network segments for unexpected FiveCo RAP protocol traffic that may indicate injection attempts

How to Mitigate CVE-2024-11595

Immediate Actions Required

• Upgrade Wireshark to version 4.4.2 or later (for 4.4.x branch) or version 4.2.9 or later (for 4.2.x branch)
• Avoid opening capture files from untrusted or unknown sources until patched versions are deployed
• Consider disabling the FiveCo RAP dissector if not required for network analysis operations
• Isolate Wireshark instances used for analyzing untrusted captures in sandboxed environments

Patch Information

Wireshark has released security updates to address this vulnerability. Users should upgrade to the latest stable version. Detailed patch information is available in the Wireshark Security Advisory WNPA-SEC-2024-14.

For users unable to immediately upgrade, the vendor advisory provides guidance on mitigating the vulnerability through dissector configuration.

Workarounds

• Disable the FiveCo RAP dissector by navigating to Analyze → Enabled Protocols and unchecking the FiveCo RAP protocol
• Use capture filters to exclude FiveCo RAP traffic if the protocol is not needed for analysis
• Process untrusted capture files using tshark with the -d option to disable specific dissectors
• Implement resource limits for Wireshark processes to prevent system-wide resource exhaustion

# Disable FiveCo RAP dissector via command line
tshark -d "tcp.port==0,fiveco_rap:disable" -r capture.pcap

# Alternative: Use editcap to filter out problematic protocols before analysis
editcap -T ether capture.pcap filtered_capture.pcap