CyberRota Analysis
AI-GeneratedThe vulnerability exists in the libpcap BPF interpreter, which fails to validate the register index for loading and storing values from scratch memory registers, allowing crafted filter programs to access sensitive OS process memory. This can lead to unauthorized memory read/write operations, potentially exposing critical data or enabling further exploitation. Organizations utilizing libpcap in their network monitoring or packet capture solutions should prioritize addressing this issue to mitigate the risk of memory corruption and data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.