CVE-2024-8645

What it actually does

The SPRT dissector in Wireshark performs insufficient validation on packet data, allowing malformed input to trigger a crash during protocol dissection.

Why it matters to the business

Network analysts lose access to packet capture tools during active troubleshooting or monitoring sessions, causing delays in incident response and operational visibility.

How an attack unfolds

An attacker crafts a malicious capture file or injects specially formed packets onto a network segment monitored by Wireshark; when the tool opens the file or processes live traffic, the SPRT dissector encounters invalid data and crashes, resulting in denial of service.

How to fix it

Update Wireshark to a build containing commit 2acd1a854babc4caae980ef9ed79ad36b6bc0362 or later; rebuild from source if using GIT or install a patched release once available.

How to confirm the fix worked

Confirm the installed Wireshark version is newer than the affected ranges and test processing of known-good SPRT traffic without crashes; review release notes for the referenced commit.

Typical attack path

1. Identify a target running vulnerable Wireshark with SPRT dissection enabled
2. Prepare a crafted pcap file or inject malformed SPRT packets
3. Deliver the file or packets to the target environment
4. Trigger Wireshark to process the input, causing the dissector to crash

How to detect it

Review application crash logs and core dumps for Wireshark processes; search system logs for abrupt termination events while processing capture files or live captures involving SPRT protocol traffic.

• wireshark.*SPRT
• dissector crash
• abort in epan

What your security team should do

• Prioritize upgrade of all Wireshark installations to the fixed commit
• Restrict opening of untrusted capture files until patched
• Monitor for Wireshark crash reports referencing the SPRT dissector