Description

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-05T19:16:55.950Z",
  "pubdate": "2026-09-05T19:16:55.950Z",
  "executiveSummary": "This vulnerability involves a classic divide-by-zero error within the libpcap Berkeley Packet Filter (BPF) interpreter. Specifically, the implementation of the 'div #k' and 'mod #k' arithmetic logic unit (ALU) instructions fails to perform necessary validation on the immediate operand 'k'.\nIf an attacker can supply a crafted BPF filter program to an application utilizing the vulnerable libpcap interpreter, they can trigger an unhandled arithmetic exception. The primary impact is an application crash, leading to a Denial of Service (DoS) condition.\nThis vulnerability affects systems relying on libpcap to process packet filters. It does not require special privileges beyond the ability to influence the BPF program loaded into the interpreter. The risk is significant for network monitoring tools, intrusion detection systems (IDS), and packet sniffers that accept user-defined or untrusted filter expressions, as an attacker can remotely terminate the process by passing a malicious filter string.",
  "technicalDetails": "The root cause of this vulnerability lies in the BPF instruction set architecture implementation within libpcap. When the BPF interpreter executes the BPF_DIV or BPF_MOD operations, it is designed to perform arithmetic operations using an immediate value 'k' provided within the bytecode instruction.\nThe interpreter logic responsible for these operations directly uses the value 'k' as the divisor without first verifying if 'k' is equal to zero. In hardware and software alike, integer division by zero is undefined and typically triggers an exception or a hardware trap.\nThe attack flow proceeds as follows: An attacker identifies an entry point where the target application allows the input of a BPF filter expression (e.g., via a network configuration interface or a command-line utility that compiles these strings). The attacker provides a crafted filter expression that forces the BPF compiler or assembler to generate an instruction containing 'div #0' or 'mod #0'. When the libpcap interpreter loads and executes this bytecode, it attempts the division or modulo operation using zero as the denominator. Due to the lack of a check, the CPU raises an arithmetic exception, and since most user-space applications are not equipped to handle hardware traps for arithmetic errors, the process is terminated immediately.\nThis is not a memory corruption vulnerability; it is a logic flaw resulting in a controlled or semi-controlled crash. Because the BPF interpreter runs within the context of the packet-processing application, the impact is strictly limited to the availability of the monitoring service. While this does not lead to arbitrary code execution, it successfully disrupts network visibility and security analysis, which can be used to bypass monitoring during a larger, stealthier network attack.\nThe vulnerable component is the libpcap BPF virtual machine. Any application linking against a version of libpcap that lacks input validation for these ALU instructions is susceptible. No authentication is typically required if the application exposes a configuration interface for filters, and the exposure is limited only by the reach of the service that accepts these filter inputs."
}