CVE-2024-9780: Wireshark ITS Dissector DoS Vulnerability

CVE-2024-9780 Overview

CVE-2024-9780 is a denial of service vulnerability affecting the Intelligent Transport Systems (ITS) dissector in Wireshark 4.4.0. The vulnerability allows an attacker to crash Wireshark through packet injection or by opening a specially crafted capture file. This flaw stems from improper initialization of variables (CWE-456) and missing initialization of resources (CWE-909), which can lead to application crashes when processing malicious ITS protocol data.

Critical Impact
Attackers can cause Wireshark to crash, disrupting network analysis activities and potentially causing data loss if unsaved captures are in progress.

Affected Products

Wireshark 4.4.0

Discovery Timeline

2024-10-10 - CVE-2024-9780 published to NVD
2024-10-17 - Last updated in NVD database

Technical Details for CVE-2024-9780

Vulnerability Analysis

This vulnerability exists within the ITS (Intelligent Transport Systems) dissector component of Wireshark. The ITS dissector is responsible for parsing and analyzing ITS protocol traffic, which is commonly used in vehicular communication systems and smart transportation infrastructure.

The root cause involves improper handling of certain data structures during packet dissection. When the ITS dissector encounters specifically crafted packet data, the application fails to properly initialize critical variables before use, leading to unpredictable behavior and ultimately causing the application to crash.

The attack requires local access, as the attacker must either inject packets on a network being captured or convince a user to open a malicious capture file. While user interaction is required (opening a file or capturing traffic), no privileges are needed to exploit this vulnerability.

Root Cause

The vulnerability is attributed to two related weaknesses:

CWE-456 (Missing Initialization of a Variable): Critical variables within the ITS dissector are not properly initialized before being accessed.
CWE-909 (Missing Initialization of Resource): Resources required for proper dissector operation are not initialized, leading to undefined behavior.

These initialization failures occur when the dissector processes malformed or unexpected ITS protocol data, causing the application to reference uninitialized memory or resources, resulting in a crash condition.

Attack Vector

The attack vector for CVE-2024-9780 is local, requiring one of two exploitation scenarios:

Packet Injection: An attacker with access to a network segment being monitored by Wireshark can inject specially crafted ITS protocol packets. When Wireshark attempts to dissect these packets in real-time, the ITS dissector crashes.
Malicious Capture File: An attacker can distribute a crafted .pcap or .pcapng capture file containing malicious ITS protocol data. When a victim opens this file in Wireshark 4.4.0, the application crashes during the dissection process.

The vulnerability can be exploited without authentication, though it requires user interaction (opening a file or actively capturing traffic). For additional technical details, refer to the GitLab Issue #20026.

Detection Methods for CVE-2024-9780

Indicators of Compromise

Unexpected Wireshark application crashes when analyzing ITS protocol traffic
Crash reports or core dumps indicating failures in the ITS dissector module
Receipt of unsolicited capture files containing ITS protocol data from untrusted sources

Detection Strategies

Monitor for repeated Wireshark crashes on systems used for network analysis
Implement file integrity monitoring on capture file directories to detect suspicious .pcap or .pcapng files
Review system logs for patterns of application crashes related to Wireshark processes

Monitoring Recommendations

Establish baselines for normal Wireshark operation and alert on crash patterns
Monitor network segments for unusual ITS protocol traffic that could indicate exploitation attempts
Track the source of capture files opened by analysts to identify potentially malicious files

How to Mitigate CVE-2024-9780

Immediate Actions Required

Upgrade Wireshark to version 4.4.1 or later immediately
Avoid opening capture files from untrusted or unknown sources
Disable the ITS dissector if not required for your analysis workflow until patching is complete

Patch Information

Wireshark has released security updates to address this vulnerability. Users should upgrade to Wireshark 4.4.1 or later. The official security advisory is available at the Wireshark Security Advisory WNPA-SEC-2024-12.

Workarounds

Disable the ITS dissector by navigating to Analyze → Enabled Protocols and unchecking "ITS" until the update can be applied
Use capture file validation tools before opening files from external sources
Run Wireshark in an isolated environment when analyzing potentially malicious traffic

bash

# Disable ITS dissector via command line
wireshark --disable-protocol its