CVE-2024-3024 is a Medium severity (CVSS 5.3) heap-based buffer overflow in tcpreplay up to version 4.4.4, in the get_layer4_v6 function of get.c. It needs local access. The record names no fixed version and says the vendor did not respond, so check upstream releases and avoid replaying untrusted capture files.
What's affected
The description names appneta tcpreplay up to 4.4.4, and the CPE data in the record lists the product under the Broadcom vendor name. Both refer to the same tool, which replays captured network traffic. The affected function is get_layer4_v6 in /tcpreplay/src/common/get.c.
The weakness is CWE-122 and CWE-787: a heap-based overflow, which is a form of out-of-bounds write. The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Local access and low privileges are required, and each of confidentiality, integrity and availability is rated low. VulDB calls it "problematic" in the description, which fits the Medium score.
No fixed version appears in the record. The references are two Google Docs and Drive links that I did not open, along with VulDB. The vendor was contacted early about the disclosure and did not respond, according to the record. Check the tcpreplay project's releases to see whether a build newer than 4.4.4 addresses the issue.
How to check if you're exposed
Find out whether tcpreplay is installed and which version you have:
tcpreplay --version
dpkg -l | grep -i tcpreplay
rpm -qa | grep -i tcpreplay
Any version up to and including 4.4.4 is in the stated range. Also look at where tcpreplay runs. Lab machines, CI jobs and test rigs that replay captures are the usual places, and the people who use them often have local shell access anyway.
What to do now
- Inventory every host that has tcpreplay installed, including test containers and CI images.
- Check the upstream project and your distribution's security tracker for a fixed build, and update when one is available.
- Replay only capture files from sources you trust, and treat files from outside your team as untrusted input.
- Run the tool as an unprivileged user in a container or virtual machine where possible.
- Rebuild container images that bundle tcpreplay once a fixed version exists.
Why it matters
Parsers for network protocols are a common home for memory safety bugs, because they read lengths and offsets from data they do not control. Here the IPv6 layer 4 parsing path writes past the end of a heap buffer. With local access required and low impact ratings, this is not an emergency, but a crash or memory corruption in a tool that processes files from many sources is worth tracking.
The record does not list this CVE as exploited in the wild. The description says the exploit has been disclosed to the public, which means the details are available to anyone who looks.
The Gold page for CVE-2024-3024 tracks the entry, and the free in-browser dependency scan at gold.safeguard.sh/scan can help find where a vulnerable package is pulled into your projects.
Quick check
Can this be exploited remotely?
The CVSS vector says local access is required. Someone would need to get a crafted capture file processed by tcpreplay on a machine they can reach.
Is there a patched release?
The record does not name one. Check the tcpreplay project releases and your distribution advisories.
Sources
Last reviewed: 19 October 2026.
