# CVE-2017-13050: The RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print()

tcpdump's RPKI-Router printer reads 4 bytes past a heap buffer when parsing a crafted pcap, causing an ASan-detected heap over-read.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: bags
- Disclosed: 2021-08-22
- CVE: CVE-2017-13050
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/802863
- Library page: https://bugbountylibrary.com/r/h1%3A802863
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:high tech:linux technique:fuzzing vuln:info-disclosure vuln:memory-corruption

**Target:** tcpdump RPKI-Router packet parser (print-rpki-rtr.c)
**Root cause:** rpki_rtr_pdu_print() calls EXTRACT_32BITS on a PDU field without verifying the captured packet buffer is long enough, so a truncated RPKI-RTR PDU causes a 4-byte read past the heap allocation.
**Steps:**
1. Clone vulnerable commit: `git clone -b 289c672020280529fd382f3502efab7100d638ec https://github.com/the-tcpdump-group/tcpdump`
2. Build with AFL and ASan: `CC=afl-gcc AFL_USE_ASAN=1 make -j` (libpcap installed)
3. Obtain the crafted pcap `rpki-rtr-oob.pcap` from the tcpdump repo tests
4. Run `tcpdump -nvr <payload>`; ASan reports heap-buffer-overflow READ of size 4 in EXTRACT_32BITS called from rpki_rtr_pdu_print print-rpki-rtr.c:243
**How found:** Fuzzing tcpdump with AFL plus AddressSanitizer surfaced the out-of-bounds read in the RPKI-Router dissector; the crashing pcap was minimized into a regression test.
**Insight:** Protocol dissectors that call EXTRACT_*BITS on length-prefixed PDU fields are prime over-read candidates; fuzz pcap inputs with ASan and target printers that trust captured-length over declared-length.