CVE-2024-24478: Insufficient Information (NVD-CWE-noinfo)
value: An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-21T17:15Z
Repository: https://github.com/wireshark/wireshark
Language: C
Files changed: epan/dissectors/packet-bgp.c
Commit date: 2023-09-22 02:03:28 +0000
Commit message: BGP: Optlen must be a 16 bit integer now

The extended option length in RFC 9072 must be stored in
a 16 bit integer to avoid stepping the offset by the wrong
value due to overflow.

Fixup commit a9a62ff576ae79e0d6afb3214a5d409ec4cdf9d7

Diff: diff --git a/epan/dissectors/packet-bgp.c b/epan/dissectors/packet-bgp.c
index 0f7f22816f2..75d9fc9a4e2 100644
--- a/epan/dissectors/packet-bgp.c
+++ b/epan/dissectors/packet-bgp.c
@@ -8439,11 +8439,11 @@ dissect_bgp_capability_item(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo,
  */
 
 static void
 dissect_bgp_open(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo)
 {
-    guint8          optlen;    /* Option Length */
+    uint16_t        optlen;    /* Option Length */
     int             ptype;     /* parameter type        */
     int             plen;      /* parameter length      */
     int             cend;      /* capabilities end      */
     int             oend;      /* options end           */
     int             offset;    /* tvb offset counter    */
@@ -11437,14 +11437,14 @@ proto_register_bgp(void)
       { &hf_bgp_open_opt_len,
         { "Optional Parameters Length", "bgp.open.opt.len", FT_UINT8, BASE_DEC,
           NULL, 0x0, "The total length of the Optional Parameters field in octets", HFILL }},
       { &hf_bgp_open_opt_extension,
         { "Optional Parameter Extension", "bgp.open.opt.extension", FT_NONE, BASE_NONE,
-          NULL, 0x0, "Optional Parameters Extension dedetected", HFILL }},
+          NULL, 0x0, "Optional Parameters Extension detected", HFILL }},
       { &hf_bgp_open_opt_extension_mark,
         { "Extension Mark", "bgp.open.opt.extension.mark", FT_UINT8, BASE_DEC,
-          NULL, 0x0, "Optional Parameters Extension dedetected", HFILL }},
+          NULL, 0x0, "Optional Parameters Extension detected", HFILL }},
       { &hf_bgp_open_opt_extension_len,
         { "Extended Length", "bgp.open.opt.extension_len", FT_UINT16, BASE_DEC,
           NULL, 0x0, "The total extended length of the Optional Parameters field in octets", HFILL }},
       { &hf_bgp_open_opt_params,
         { "Optional Parameters", "bgp.open.opt", FT_NONE, BASE_NONE,

Vulnerable code:     guint8          optlen;    /* Option Length */
          NULL, 0x0, "Optional Parameters Extension dedetected", HFILL }},
          NULL, 0x0, "Optional Parameters Extension dedetected", HFILL }},
Fixed code:     uint16_t        optlen;    /* Option Length */
          NULL, 0x0, "Optional Parameters Extension detected", HFILL }},
          NULL, 0x0, "Optional Parameters Extension detected", HFILL }},