CVE-2017-16808

What it actually does

Heap-based buffer over-read in tcpdump's aoe_print function (print-aoe.c) and lookup_emem (addrtoname.c) when parsing malformed AOE packets, leading to crashes or abnormal termination.

Why it matters to the business

Packet capture tools may unexpectedly crash during analysis of network traffic, interrupting monitoring, forensics, or troubleshooting workflows and delaying incident response.

How an attack unfolds

An attacker crafts a specially malformed AOE packet and causes the vulnerable tcpdump instance to process it during capture or replay, triggering the buffer over-read and resulting in a denial-of-service condition.

How to fix it

Upgrade tcpdump to version 4.9.3 or later. For the listed affected products, update to cert-manager-1.11 (Chainguard) 1.11.5-r10 or cert-manager-1.11 (Wolfi) 1.11.5-r10 and rebuild any dependent images.

How to confirm the fix worked

Verify tcpdump reports version 4.9.3+, confirm the updated packages are installed in the relevant images, and test packet parsing with known AOE traffic samples to ensure no crashes occur.

Typical attack path

1. Craft a malicious AOE packet containing invalid length or address fields
2. Deliver the packet onto a network segment monitored by tcpdump
3. Trigger tcpdump to parse the packet via live capture or pcap replay
4. Induce heap over-read leading to process crash

How to detect it

Review system and application logs for tcpdump segmentation faults or abrupt terminations while processing network captures; correlate with packet sources containing AOE protocol traffic.

What your security team should do

• Prioritize upgrade of all tcpdump instances to the fixed versions within the next maintenance window
• Scan container images for the listed affected packages and rebuild with patched versions
• Add tcpdump version checks to CI/CD pipelines to prevent reintroduction of vulnerable builds