Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
Wireshark, a widely used network protocol analyzer, is vulnerable to a denial-of-service (DoS) attack due to an infinite loop within its BitTorrent DHT dissector. Attackers can trigger this vulnerability by injecting malicious packets or providing a crafted capture file, causing Wireshark to consume excessive resources and become unresponsive, potentially disrupting network analysis and security monitoring.
Step 1: Payload Delivery: An attacker crafts a malicious DHT packet or creates a capture file (.pcap or .pcapng) containing such a packet. This packet is designed to trigger the vulnerability within the Wireshark DHT dissector.
Step 2: Packet Injection (Live Capture): If the attacker is performing a live capture, the malicious packet is injected onto the network. Wireshark, configured to capture network traffic, intercepts the packet.
Step 3: File Loading (Capture File): If the attack involves a capture file, the attacker provides the crafted .pcap or .pcapng file to a user or system administrator who then opens it in Wireshark.
Step 4: Dissection Trigger: Wireshark's DHT dissector attempts to parse the malicious packet. The crafted packet contains data that, when processed by the flawed logic, causes the dissector to enter an infinite loop.
Step 5: Resource Exhaustion: The infinite loop consumes CPU resources, leading to high CPU utilization and potentially causing Wireshark to become unresponsive or crash. This constitutes a denial-of-service condition.
The vulnerability lies within the BitTorrent DHT dissector in Wireshark. Specifically, an infinite loop is triggered when processing malformed or crafted DHT packets. The dissector, responsible for parsing and interpreting DHT protocol data, enters an endless cycle due to a logic error in how it handles certain DHT message types or data structures. This error likely stems from incorrect boundary checks or improper handling of recursive data structures within the DHT protocol implementation. When the dissector encounters the problematic data, it repeatedly attempts to process it, consuming CPU resources and preventing the program from progressing. The root cause is a flaw in the parsing logic, leading to a control flow that never terminates under specific input conditions. This is not a buffer overflow or memory corruption issue, but a logic error that results in a resource exhaustion condition.