CVE-2023-7256: tcpdump libpcap Double Free
Vulnerability summary
CVE-2023-7256 is a medium (CVSS 4.4) Double Free vulnerability in tcpdump libpcap. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 8Timeline
- 30-08-2024PublishedVulnerability first disclosed.
- 03-09-2024Last modifiedVulnerability information updated.
Description
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
0.00 pp
From 0.24% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libpcapAll versions (No fix recorded) | < 1.10.5-1
Tcpdump1 product
- libpcap< 1.10.5
The tcpdump group1 product
- libpcap≥ 1.8.0, < 1.9.0 | ≥ 1.9.0, < 1.10.0 | ≥ 1.10.x, ≤ 1.10.4
3 vendors · 3 products
