CVE-2025-51006

{
  "id": "CVE-2025-51006",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-22T14:15:49.713",
  "lastModified": "2026-11-05T23:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. This vulnerability is triggered when tcpedit_dlt_cleanup() indirectly invokes the cleanup routine multiple times on the same memory region. By supplying a specifically crafted pcap file to the tcprewrite binary, a local attacker can exploit this flaw to cause a Denial of Service (DoS) via memory corruption."
    },
    {
      "lang": "es",
      "value": "En tcprewrite de tcpreplay, una vulnerabilidad de doble liberación ha sido identificada en la función dlt_linuxsll2_cleanup() en plugins/dlt_linuxsll2/linuxsll2.c. Esta vulnerabilidad se activa cuando tcpedit_dlt_cleanup() invoca indirectamente la rutina de limpieza múltiples veces en la misma región de memoria. Al proporcionar un archivo pcap específicamente diseñado al binario tcprewrite, un atacante local puede explotar esta falla para causar una Denegación de Servicio (DoS) a través de corrupción de memoria."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-22T15:52:02.489600Z",
          "id": "CVE-2025-51006",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:broadcom:tcpreplay:4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "77EA13EB-9DD4-401E-99D3-CB4DD72A2306"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/appneta/tcpreplay/issues/926",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/sy460129/CVE-2025-51006",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}