CVE-2024-11596

What it actually does

The ECMP dissector in Wireshark crashes when processing specially crafted packets or capture files, resulting in denial of service.

Why it matters to the business

Network analysts lose access to Wireshark for troubleshooting and security investigations until the application is restarted, delaying incident response and operational tasks.

How an attack unfolds

An attacker crafts a malicious network capture file containing invalid ECMP data or injects packets onto a network that is later captured and opened in an affected Wireshark version, triggering an immediate crash of the dissector and application.

How to fix it

Upgrade Wireshark to a version containing commit 9947b17309f435fe6d3dfe5595f43995cb42709e or later; apply the corresponding Ubuntu QEMU package updates if that component is in use.

How to confirm the fix worked

Confirm the installed Wireshark version is newer than 4.4.1 or 4.2.8 and test that the application remains stable when opening a known-bad ECMP capture file.

Typical attack path

1. Identify a target using Wireshark for packet analysis
2. Generate or inject malformed ECMP traffic into a capture the target will open
3. Deliver the crafted capture file or induce the target to capture the traffic
4. Trigger the ECMP dissector to process the malformed data causing a crash

How to detect it

Review application crash logs and core dumps on analyst workstations for Wireshark process terminations shortly after opening capture files; correlate with file access timestamps of suspicious pcap files.

What your security team should do

• Immediately upgrade all Wireshark installations to the fixed commit or newer releases
• Restrict opening of untrusted capture files until patches are applied
• Monitor for Wireshark crash reports in endpoint logs as a temporary detection measure