CVE-2024-24479: Wireshark Buffer Overflow DoS Vulnerability

CVE-2024-24479 Overview

CVE-2024-24479 describes a reported buffer overflow [CWE-120] in Wireshark before version 4.2.0. The flaw is located in the wsutil/to_str.c file, specifically within the format_fractional_part_nsecs component. A remote attacker can reportedly trigger the condition to cause a denial of service when Wireshark processes crafted input.

The Wireshark project disputes this CVE. According to the vendor, neither release 4.2.0 nor any other release was affected by the reported condition. A related commit in wsutil/to_str.h modifies the signature of format_fractional_part_nsecs from returning void to returning int, hardening the function's bounds handling.

Critical Impact
A remote attacker can send crafted traffic or capture data to Wireshark to trigger a denial of service against the analyst's host. The vendor disputes the existence of the flaw in released versions.

Affected Products

Wireshark versions prior to 4.2.0 (disputed by vendor)
Fedora 40 packaged distributions of Wireshark
Components: wsutil/to_str.c and format_fractional_part_nsecs

Discovery Timeline

2024-02-21 - CVE-2024-24479 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-24479

Vulnerability Analysis

The report identifies a buffer overflow in wsutil/to_str.c, the Wireshark utility file responsible for converting values into string representations for protocol dissection and display. The implicated function, format_fractional_part_nsecs, formats the fractional nanosecond portion of timestamps used throughout packet decoding.

If the function writes past the end of its destination buffer when handling certain inputs, Wireshark could crash while parsing a capture file or live traffic. Because Wireshark frequently runs with elevated privileges or analyst-level access, a crash interrupts forensic workflows and incident response activities.

The Wireshark maintainers dispute the report and state that no released version is affected. The upstream commit c3720cff158c265dec2a0c6104b1d65954ae6bfd modifies format_fractional_part_nsecs to return an int instead of void, enabling callers to detect truncation and avoid undefined behavior.

Root Cause

The reported root cause is improper buffer length handling inside format_fractional_part_nsecs. The original void return type prevented callers from verifying whether the requested formatting fit within the destination buffer.

Attack Vector

Exploitation requires the victim to open a malicious packet capture file or process attacker-supplied network traffic in Wireshark. No authentication or user privilege is required on the attacker side. Successful triggering produces a denial of service against the analyst workstation.

// Source: https://github.com/wireshark/wireshark/commit/c3720cff158c265dec2a0c6104b1d65954ae6bfd
// Patch in wsutil/to_str.h - signature change for format_fractional_part_nsecs

 WS_DLL_PUBLIC gchar *eui64_to_str(wmem_allocator_t *scope, const guint64 ad);

-WS_DLL_PUBLIC void format_fractional_part_nsecs(gchar *, size_t, guint32, const char *, int);
+WS_DLL_PUBLIC int format_fractional_part_nsecs(gchar *, size_t, guint32, const char *, int);

 WS_DLL_PUBLIC void display_epoch_time(gchar *, size_t, const nstime_t *, int);

The patch changes the function's return type from void to int, allowing callers to detect formatting errors and bounded writes. See the GitHub Wireshark Commit for full context.

Detection Methods for CVE-2024-24479

Indicators of Compromise

Unexpected Wireshark or tshark process crashes when opening .pcap or .pcapng files received from untrusted sources
Abnormal core dump generation referencing wsutil/to_str.c or format_fractional_part_nsecs frames
Capture files with malformed or extreme nanosecond timestamp fields received via email, chat, or shared drives

Detection Strategies

Inventory installed Wireshark versions across analyst workstations and SOC hosts to identify builds prior to 4.2.0
Monitor endpoint telemetry for repeated termination of wireshark.exe, wireshark, or tshark processes with non-zero exit codes
Flag capture files sourced from external collaborators before analysts open them in graphical Wireshark

Monitoring Recommendations

Forward Wireshark crash events and Windows Application logs to a central SIEM for correlation
Track package update events on Linux endpoints to confirm the Fedora wireshark advisory has been applied
Alert on capture files staged in shared directories that have not been validated by command-line capinfos

How to Mitigate CVE-2024-24479

Immediate Actions Required

Update Wireshark to version 4.2.0 or later on all analyst workstations and forensic VMs
Apply the Fedora package update referenced in the Fedora Package Announcement
Review the GitHub Gist Security Update and the upstream commit before triaging exposure, given the vendor dispute

Patch Information

The upstream change is tracked in commit c3720cff158c265dec2a0c6104b1d65954ae6bfd, which adjusts the signature of format_fractional_part_nsecs in wsutil/to_str.h. Fedora users should install the updated wireshark package distributed through the package announcement. Note that the Wireshark project disputes that any released version is vulnerable, so the change should be treated as defense-in-depth hardening.

Workarounds

Open untrusted capture files using tshark in an isolated sandbox or container rather than the GUI client
Disable automatic file association so .pcap and .pcapng files do not launch Wireshark on double-click
Restrict the sources of capture files to internal collectors and known peers until patches are validated

bash

# Verify installed Wireshark version on Linux
wireshark --version | head -n 1

# Update Wireshark on Fedora
sudo dnf upgrade --refresh wireshark wireshark-cli

# Confirm the patched function signature is present in headers
grep -n "format_fractional_part_nsecs" /usr/include/wireshark/wsutil/to_str.h