A double free vulnerability in the tcpreplay utility, specifically within the tcprewrite component, presents a risk of memory corruption and denial of service.

This vulnerability is a double free flaw occurring in the dlt_linuxsll2_cleanup function, which is triggered when memory is cleaned up multiple times. An attacker can exploit this by providing a malicious pcap file to the tcprewrite binary, requiring local access and user interaction to execute.

The vulnerability carries a CVSS score of 7.8, reflecting a significant risk to availability and system integrity. Successful exploitation leads to a denial of service, which can disrupt network traffic analysis workflows and critical security monitoring processes that rely on the tcpreplay suite.

Immediate Action: Monitor the official tcpreplay repository for patch releases and apply updates as soon as they become available.

Proactive Monitoring: Review system logs for unexpected crashes of the tcprewrite binary and restrict access to the utility to authorized users only.

Compensating Controls: Implement strict input validation on all pcap files before processing them with external tools to prevent the ingestion of malicious or malformed traffic captures.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub issue tracker provided in the enrichment data.

Given the availability of a proof-of-concept and the potential for service disruption, organizations utilizing tcpreplay should prioritize monitoring for vendor updates. Ensure that the tcprewrite utility is not run with elevated privileges unless strictly necessary, and maintain strict control over the pcap files allowed for processing to minimize the attack surface.