Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely. CVE-2026-6244: libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero. CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures. CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process. CVE-2026-0799: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libpcap | 14:1.10.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libpcap-debuginfo | 14:1.10.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libpcap-debugsource | 14:1.10.7-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libpcap-devel | 14:1.10.7-1.amzn2023.0.1 |
Vulnerabilities 5
-
High 8.7
OOBR and OOBW in libpcap before 1.10.7
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter p…
-
High 7.5
infinte loop in libpcap before 1.10.7
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted …
-
Medium 5.5
abort() in libpcap before 1.10.7 on an invalid BPF opcode
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
-
Medium 5.5
OOBR in libpcap before 1.10.7
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a cr…
-
Medium 5.5
division by zero in libpcap before 1.10.7
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0799.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31911.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31912.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-6244.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-6554.html