Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-05T23:17:02.293Z",
  "pubdate": "2026-11-05T23:17:02.293Z",
  "executiveSummary": "FastNetMon version 1.2.9 and earlier contains a critical out-of-bounds (OOB) read vulnerability within its packet capture infrastructure. The flaw resides in the parse_packet() callback function, which fails to perform adequate bounds checking on captured network frames before processing header fields.\nThe vulnerability allows an unauthenticated, remote attacker to trigger a denial-of-service (DoS) condition by crafting network packets with specific header attributes, such as truncated frames or manipulated IPv4 header lengths. When these packets are processed by the pcap_collector, the application attempts to access memory regions outside the allocated capture buffer, resulting in immediate process termination.\nBecause the pcap_collector handles live traffic, this vulnerability exposes the service to stability risks from malicious or malformed network traffic. Successful exploitation does not necessarily require authentication but depends on the target system being configured with pcap enabled. Given the nature of the vulnerability, the impact is primarily service availability, although OOB read vulnerabilities can potentially lead to sensitive information disclosure if memory contents are leaked to logging facilities or protocol outputs.",
  "technicalDetails": "The vulnerability is situated in src/pcap_plugin/pcap_collector.cpp within the parse_packet() callback function, which is utilized by pcap_loop to process network traffic. The root cause of the issue is a failure to validate the length of captured packet data against the structure of the headers being parsed.\nSpecifically, when pcap is enabled, the function processes captured frames without verifying that the caplen (captured length) field, provided by the pcap library, is sufficient to accommodate the parsed protocol headers. An attacker can exploit this by injecting a specially crafted packet featuring either a truncated payload or an IPv4 header that specifies an internal length inconsistent with the actual frame size.\nThe exploitation flow proceeds as follows: 1) The attacker sends a malformed packet to the network interface monitored by FastNetMon. 2) The pcap_loop mechanism captures the frame and passes the buffer and metadata to the parse_packet() function. 3) The parse_packet() function proceeds to interpret the buffer as an IP packet. 4) Due to the lack of boundary validation, the parser attempts to dereference memory pointers for the IP or transport layer headers based on the attacker-controlled length fields. 5) These pointers reference memory addresses located outside the bounds of the provided packet buffer.\nThis out-of-bounds memory read triggers a segmentation fault or similar memory protection violation, causing the FastNetMon process to crash. Since this occurs within the main packet processing loop, it leads to a complete denial-of-service for the DDoS detection sensor. The lack of validation on the IPv4 header length field is particularly critical, as the 'Internet Header Length' (IHL) field can be manipulated to point far beyond the actual data received in the packet capture buffer. Because this occurs at the ingress point of the sensor, it represents a significant risk for systems directly exposed to untrusted network traffic. There are currently no patches available, meaning the vulnerable code path remains reachable in all versions up to 1.2.9."
}