Wireshark TLS Protocol Dissector Infinite Loop Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in Wireshark versions 4.6.0 through 4.6.4. The issue arises in the TLS protocol dissector, where the handling of the Encrypted Client Hello (ECH) can lead to an infinite loop. This occurs because the dissection process fails to properly manage certain extension types, causing Wireshark to consume 100% CPU indefinitely.

Impact

Exploitation of this vulnerability causes Wireshark or TShark to enter an infinite loop, resulting in 100% CPU usage.

Reproduction

The vulnerability can be reproduced by capturing TLS traffic that includes an ECH payload. After decrypting the ECH with the appropriate private key, the inner ClientHello must contain a cipher suite list or extensions larger than those in the outer ClientHello. This condition triggers the infinite loop during passive dissection.

Remediation

Users can upgrade to Wireshark version 4.6.5, where this vulnerability has been fixed.