CVE-2024-24476: Fedora Buffer Overflow Vulnerability

CVE-2024-24476 Overview

CVE-2024-24476 describes a reported buffer overflow in Wireshark versions before 4.2.0. The flaw is located in epan/addr_resolv.c and the ws_manuf_lookup_str() size handling components. A remote attacker could trigger the condition to cause a denial of service in the packet analyzer. The vulnerability is classified under [CWE-119] Improper Restriction of Operations within the Bounds of a Memory Buffer. Wireshark, the vendor, disputes this CVE and states that neither release 4.2.0 nor any other release was affected. Fedora Project packages that ship Wireshark are also listed as affected in NVD data.

Critical Impact
A network-reachable attacker could cause Wireshark to crash through crafted input processed by the address resolution component, though the vendor disputes that any release is actually vulnerable.

Affected Products

Wireshark versions before 4.2.0 (disputed by vendor)
Fedora Project Fedora 40
Wireshark address resolution component (epan/addr_resolv.c)

Discovery Timeline

2024-02-21 - CVE-2024-24476 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24476

Vulnerability Analysis

The report identifies a buffer overflow condition in Wireshark's address resolution subsystem. The affected code path resides in epan/addr_resolv.c, specifically in size handling logic tied to ws_manuf_lookup_str(). This routine performs manufacturer OUI (Organizationally Unique Identifier) lookups for MAC address resolution during packet dissection. The reported flaw impacts availability only, with no confirmed effect on confidentiality or integrity. The Wireshark project disputes the finding and states that no released version is affected, which is documented in the Wireshark Issue Tracker entry 19344.

Root Cause

The reported root cause is improper bounds checking within the size components of ws_manuf_lookup_str() in epan/addr_resolv.c. When Wireshark processes address resolution data, insufficient validation of size parameters could permit writes or reads outside the intended buffer. The referenced upstream commit 108217f4 documents changes in this area. Because the vendor disputes the CVE, the code path may not be reachable in shipped builds with the reported inputs.

Attack Vector

Exploitation requires no authentication and no user interaction beyond capturing or opening attacker-controlled network traffic. An attacker sends crafted packets that Wireshark processes during live capture, or supplies a malicious capture file for offline analysis. When the address resolution routine handles the crafted OUI-related data, the buffer overflow condition can crash the process. A public proof of concept is referenced on GitHub Gist. Verified exploitation code is not available and the vendor disputes the issue.

Detection Methods for CVE-2024-24476

Indicators of Compromise

Unexpected Wireshark process crashes or termination during live packet capture on hosts running versions prior to 4.2.0.
Malformed capture files (.pcap, .pcapng) originating from untrusted sources that trigger dissector faults.
Core dumps or crash reports referencing addr_resolv.c or ws_manuf_lookup_str() in the stack trace.

Detection Strategies

Monitor endpoint telemetry for repeated Wireshark or tshark process crashes on analyst workstations.
Track file provenance for capture files opened by SOC analysts and flag those sourced from external or unverified locations.
Correlate Wireshark version inventory against the disputed vulnerable range to identify hosts requiring review.

Monitoring Recommendations

Alert on abnormal exit codes from packet analysis tools running on shared or forensic workstations.
Review application crash logs on Fedora 40 systems for Wireshark segmentation faults tied to name resolution enabled during capture.
Track the Wireshark Issue Tracker for updates to the dispute status.

How to Mitigate CVE-2024-24476

Immediate Actions Required

Update Wireshark to the latest stable release available from the vendor to receive all cumulative dissector hardening.
Apply Fedora package updates referenced in the Fedora Package Announcement.
Restrict opening of capture files sourced from untrusted parties on analyst systems.

Patch Information

The Wireshark project disputes that any release is affected. Users should still apply the latest stable Wireshark release and the corresponding Fedora package update. Reference the upstream commit and the Wireshark Issue Tracker for the vendor position and any code changes touching epan/addr_resolv.c.

Workarounds

Disable network name resolution in Wireshark preferences to reduce reliance on the affected ws_manuf_lookup_str() code path during capture.
Analyze untrusted capture files inside an isolated virtual machine or sandbox rather than on production analyst workstations.
Limit live capture privileges by running Wireshark under a non-privileged account with dumpcap handling capture separately.

bash

# Configuration example: disable name resolution when running tshark/Wireshark
tshark -n -r suspicious_capture.pcapng
# -n disables all name resolution (MAC, network, transport)

# Verify installed Wireshark version on Fedora
rpm -q wireshark
sudo dnf update wireshark