{"id":"CVE-2024-2397","summary":"infinite loop in the PPP printer of tcpdump","details":"Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL .pcap savefile.  This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21.","modified":"2026-08-12T15:17:01.980481Z","published":"2024-04-12T13:22:01.636Z","related":["openSUSE-SU-2024:14305-1"],"database_specific":{"cna_assigner":"Tcpdump","cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2397.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0d4083e"},{"fixed":"b9811ef"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GEZRGR3QCW2ZNFIAWMZZOG4ZLFLFNG2M/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HUUI2MBVHFENXNBCHDQZP2RBBA2VD5HG/"},{"type":"WEB","url":"https://lists.freebsd.org/archives/freebsd-security/2024-September/000298.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2397.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2397"},{"type":"FIX","url":"https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/the-tcpdump-group/tcpdump","events":[{"introduced":"0"},{"fixed":"b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2"}],"database_specific":{"source":"REFERENCES"}}],"versions":["tcpdump-4.99.0-bp","tcpdump-4.99-bp","tcpdump-4.9.0-bp","tcpdump-4.7.0-bp","tcpdump-4.6.0-bp","tcpdump-4.6.0","tcpdump-4.5.0","tcpdump-3.8-bp","tcpdump-3.7.1","tcpdump-3.6.1","tcpdump-3.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2397.json","vanir_signatures_modified":"2026-08-12T15:17:01Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2","target":{"file":"print.c","function":"pretty_print_packet"},"deprecated":false,"digest":{"function_hash":"335536015126687036770576115752116002197","length":2740},"id":"CVE-2024-2397-1212083e"},{"target":{"function":"ppp_hdlc","file":"print-ppp.c"},"deprecated":false,"digest":{"function_hash":"131834283053629514890061248017437609093","length":1567},"id":"CVE-2024-2397-6573a49f","signature_type":"Function","signature_version":"v1","source":"https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2"},{"id":"CVE-2024-2397-84e28906","signature_type":"Line","signature_version":"v1","source":"https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2","target":{"file":"print-ppp.c"},"deprecated":false,"digest":{"line_hashes":["69553224263466035267628122805516107488","312352556822752645234500619202123157215","3025699069882131222630385708257604059","231193884794974787337537196175761302314","221334477870218758487133493026554102404","129763976976792336455041801411832291367","134502927234054351545039037831720188015","33296973496010029355943781333802482612","38168603463089486477615648781975114106","19775740154256628707941034424839304827","16477715467891890246881985723251000825","205283430231109500976806257459037288912","262471679429031711782046711639794533219","323257524624458794945323072097832552377","90170563986454716362359969009842994443","294128755616988493170036310599469944434","21037863054476785696200570908841203730","122216010055386831831738568837270953087","246882897524905057422211599151947223789","242988443043125547435769460257305667660","331415198281874077416473372510035679675","242592041392593559629880760978492612798","34399107820989378140315755770884970430","336070414462857688477510352569462758239","286360864741895255291773769119396563413","131735425642272683529387043084979617928","318800481765160358827203813337966196909","267818040559976848034704562974177428856","3343623855280031461028062098301904579"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["28241414782858801219235938757289258134","325926913707002472839481080520258471564","197198277108926298048735406289743985480","127615399476199519748573788592430302242"],"threshold":0.9},"id":"CVE-2024-2397-df3e7461","signature_type":"Line","signature_version":"v1","source":"https://github.com/the-tcpdump-group/tcpdump/commit/b9811ef5bb1b7d45a90e042f81f3aaf233c8bcb2","target":{"file":"print.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}