CVE-2024-54192: Tcpreplay v4.5.1 DoS Vulnerability

CVE-2024-54192 Overview

CVE-2024-54192 is a Denial of Service vulnerability affecting Tcpreplay v4.5.1, a popular network traffic replay tool used for testing network devices and applications. The vulnerability exists in the tcpedit_dlt_getplugin function located at src/tcpedit/plugins/dlt_utils.c. A local attacker can exploit this flaw by crafting a malicious file that, when processed by Tcpreplay, causes the application to become unresponsive or crash.

Critical Impact

Local attackers can cause denial of service conditions by supplying crafted input files to Tcpreplay, potentially disrupting network testing and security analysis workflows.

Affected Products

• Tcpreplay v4.5.1
• Potentially earlier versions of Tcpreplay (unconfirmed)

Discovery Timeline

• 2026-02-10 - CVE-2024-54192 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2024-54192

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), which occurs when software does not properly control the allocation and maintenance of a limited resource, thereby enabling an attacker to influence the amount of resources consumed, eventually leading to resource exhaustion.

The vulnerable function tcpedit_dlt_getplugin in src/tcpedit/plugins/dlt_utils.c fails to properly validate input when processing Data Link Type (DLT) plugins. When a specially crafted file is provided as input, the function enters a state that causes excessive resource consumption or an unrecoverable error condition, resulting in a denial of service.

The attack requires local access to the system and user interaction (the victim must process the malicious file). While this limits the attack surface, it remains a concern in environments where Tcpreplay is used for automated network testing with files from untrusted sources.

Root Cause

The root cause is improper input validation in the DLT plugin utility functions. The tcpedit_dlt_getplugin function does not adequately sanitize or validate the contents of input files before processing them, allowing malformed data to trigger resource exhaustion or crash conditions. This is a classic example of insufficient input validation leading to denial of service.

Attack Vector

The attack vector is local, requiring the attacker to have access to the target system or the ability to supply a crafted file to a user who will process it with Tcpreplay. The attack scenario typically involves:

1. An attacker creates a specially crafted pcap or similar capture file
2. The malicious file is provided to a victim (through shared storage, email, or other means)
3. The victim processes the file using Tcpreplay utilities that invoke the vulnerable function
4. The application crashes or hangs, causing denial of service

The vulnerability requires user interaction to trigger, which somewhat limits its exploitability in automated environments.

Detection Methods for CVE-2024-54192

Indicators of Compromise

• Unexpected crashes or hangs of Tcpreplay processes when processing capture files
• Core dumps or crash reports related to tcpedit_dlt_getplugin or dlt_utils.c
• Unusual resource consumption (CPU, memory) by Tcpreplay processes
• Error logs indicating failures in DLT plugin initialization or processing

Detection Strategies

• Monitor system logs for Tcpreplay process crashes or abnormal terminations
• Implement file integrity monitoring on directories where Tcpreplay input files are stored
• Use application crash monitoring to detect patterns of denial of service attempts
• Deploy endpoint detection solutions that can identify resource exhaustion patterns

Monitoring Recommendations

• Enable verbose logging for Tcpreplay operations in testing environments
• Monitor process resource utilization when Tcpreplay is active
• Implement alerting for repeated Tcpreplay process failures
• Review input files from untrusted sources before processing with Tcpreplay

How to Mitigate CVE-2024-54192

Immediate Actions Required

• Upgrade Tcpreplay to a patched version when available
• Avoid processing capture files from untrusted or unknown sources
• Implement input validation on files before processing with Tcpreplay
• Consider running Tcpreplay in a sandboxed environment to limit impact of crashes

Patch Information

A fix has been proposed via a GitHub Pull Request in the Tcpreplay repository. Users should monitor the official repository for release updates containing this fix. The vulnerability is tracked in GitHub Issue #902.

Workarounds

• Only process capture files from trusted and verified sources
• Run Tcpreplay in an isolated environment or container to limit the impact of denial of service
• Implement resource limits (ulimits) on Tcpreplay processes to prevent complete system resource exhaustion
• Consider using network traffic analysis tools to pre-validate capture files before processing

# Resource limiting configuration example
# Set resource limits before running tcpreplay to contain potential DoS impact
ulimit -v 1048576  # Limit virtual memory to 1GB
ulimit -t 300      # Limit CPU time to 5 minutes
ulimit -f 104857600  # Limit file size to 100MB

# Run tcpreplay with timeout wrapper
timeout 60 tcpreplay -i eth0 potentially_untrusted_file.pcap