#1142865 After upgrading to 0.23.2-2, Wireshark segfaults

Package:
libfalcosecurity0t64
Source:
libfalcosecurity0t64
Description:
Core libraries for Falco and Sysdig
Submitter:
Vincent Bernat
Date:
2026-08-05 09:15:01 UTC
Severity:
normal
#1142865#5
Date:
2026-07-27 06:40:16 UTC
From:
To:
Hey!

After upgrading to 0.23.2-2, Wireshark segfaults at start:

(gdb) bt
#0  std::__detail::_Mod_range_hashing::operator() (this=<optimized out>,
__num=10486467086191084205, __den=0)
     at /usr/include/c++/15/bits/hashtable_policy.h:584
#1  std::__detail::_Hash_code_base<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, libsinsp::state::base_table*>,
std::__detail::_Select1st, std::hash<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > >,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
true>::_M_bucket_index (this=0x55a018fbc290, __c=10486467086191084205,
__bkt_count=0)
     at /usr/include/c++/15/bits/hashtable_policy.h:1093
#2  std::_Hashtable<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, libsinsp::state::base_table*>,
std::allocator<std::pair<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const,
libsinsp::state::base_table*> >, std::__detail::_Select1st,
std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > >,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy,
std::__detail::_Hashtable_traits<true, false, true> >::_M_bucket_index
     (this=0x55a018fbc290, __c=10486467086191084205) at
/usr/include/c++/15/bits/hashtable.h:811
#3  std::_Hashtable<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, libsinsp::state::base_table*>,
std::allocator<std::pair<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const,
libsinsp::state::base_table*> >, std::__detail::_Select1st,
std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > >,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy,
std::__detail::_Hashtable_traits<true, false, true> >::_M_locate
     (this=0x55a018fbc290, __k="threads") at
/usr/include/c++/15/bits/hashtable.h:2280
#4  std::_Hashtable<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, libsinsp::state::base_table*>,
std::allocator<std::pair<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const,
libsinsp::state::base_table*> >, std::__detail::_Select1st,
std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > >,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy,
std::__detail::_Hashtable_traits<true, false, true>
 >::_M_emplace_uniq<std::pair<std::__cxx11::bas--Type <RET> for more, q
to quit, c to continue without paging--c
ic_string<char, std::char_traits<char>, std::allocator<char> > const,
libsinsp::state::base_table*> > (this=0x55a018fbc290)
     at /usr/include/c++/15/bits/hashtable.h:2351
#5  std::_Hashtable<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::pair<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const, libsinsp::state::base_table*>,
std::allocator<std::pair<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const,
libsinsp::state::base_table*> >, std::__detail::_Select1st,
std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > >,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy,
std::__detail::_Hashtable_traits<true, false, true> >::insert
(this=0x55a018fbc290, __v=...)
     at /usr/include/c++/15/bits/hashtable.h:1067
#6  std::unordered_map<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
libsinsp::state::base_table*, std::hash<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > >,
std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >,
std::allocator<std::pair<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const,
libsinsp::state::base_table*> > >::insert (this=0x55a018fbc290, __x=...)
     at /usr/include/c++/15/bits/unordered_map.h:612
#7  libsinsp::state::table_registry::add_table<long>
(this=0x55a018fbc290, t=<optimized out>)
     at ./userspace/libsinsp/state/table_registry.h:94
#8  sinsp::sinsp (this=0x55a018fbb9e0, with_metrics=<optimized out>) at
./userspace/libsinsp/sinsp.cpp:224
#9  0x00007f3c8568b1c0 in sinsp_span_t::sinsp_span_t
(this=0x55a018fbb9e0) at ./plugins/epan/falco_events/sinsp-span.cpp:71
#10 create_sinsp_span () at ./plugins/epan/falco_events/sinsp-span.cpp:151
#11 0x00007f3c856879c5 in proto_register_falcoplugin () at
./plugins/epan/falco_events/packet-falco-events.c:1695
#12 0x00007f3c9bf28a2f in g_slist_foreach () at
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007f3c968cd5ad in proto_init
     (register_all_plugin_protocols_list=<optimized out>,
register_all_plugin_handoffs_list=0x0, cb=cb@entry=0x55a00a2b2e40
<splash_update(register_action_e, char const*, void*)>,
client_data=client_data@entry=0x0) at ./epan/proto.c:640
#14 0x00007f3c96885d39 in epan_init
     (cb=0x55a00a2b2e40 <splash_update(register_action_e, char const*,
void*)>, client_data=0x0, load_plugins=<optimized out>)
     at ./epan/epan.c:343
#15 0x000055a009e15853 in main (argc=<optimized out>,
qt_argv=0x7ffebbd81bb8) at ./ui/qt/main.cpp:775

Downgrading to 0.20.0-4.1+b1 in testing fixes this issue.

#1142865#10
Date:
2026-07-27 11:25:25 UTC
From:
To:
Control: severity -1 serious

This was also caught by wireshark's autopkgtests, and is blocking
falcosecurity-libs' migration to testing. Also this is blocking the abseil
transition.

Cheers,
Emilio

#1142865#17
Date:
2026-07-28 14:49:15 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
wireshark, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142865@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Samuel Henrique <samueloph@debian.org> (supplier of updated wireshark package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 28 Jul 2026 07:02:37 -0700
Source: wireshark
Architecture: source
Version: 4.6.6-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Samuel Henrique <samueloph@debian.org>
Closes: 1142865
Changes:
 wireshark (4.6.6-2) unstable; urgency=medium
 .
   * Rebuild with new falcosecurity-libs (closes: #1142865)
Checksums-Sha1:
 7f87535bb46eeeb3468584f9ddd229c57c5762fe 3698 wireshark_4.6.6-2.dsc
 45b68bfb651669fa2375df7b64dae6270dc8d9be 91056 wireshark_4.6.6-2.debian.tar.xz
 2af8f7e258f8534af3e7f35802d2e4a822a40804 26600 wireshark_4.6.6-2_amd64.buildinfo
Checksums-Sha256:
 28ce688bfea66d31525fb2e7ce37084ab10bd27a8974afb60c800cf0ef1ee022 3698 wireshark_4.6.6-2.dsc
 f4d1a375fbbf385f0c0eec47719c472cefd8d6bdc9936c0c753ebd4e0461b640 91056 wireshark_4.6.6-2.debian.tar.xz
 8abf7b908735633575c944cf301a601a9786d3c5e26db6287975a3343ea9f2a5 26600 wireshark_4.6.6-2_amd64.buildinfo
Files:
 a8a147e11fc3c0c237d19d5df826f120 3698 net optional wireshark_4.6.6-2.dsc
 ab1602fafa99510d9616e753ce60546a 91056 net optional wireshark_4.6.6-2.debian.tar.xz
 b5bf41518757deacb7658b84b8a7a6a0 26600 net optional wireshark_4.6.6-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBdtqg34QX0sdAsVfu6n6rcz7RwcFAmpovUsACgkQu6n6rcz7
RwcNExAAmf1XkKqQ2y/yiRPxuTCdE9uKZHctZXegJlIj4dHtitVzT0KJN+s0TUX7
8+pipq95NQmWqL8ugqLDCEtolDbDJVeZI+E9pYPDv1QEjwD59/WiIrSMrlCtxMzj
iXWeJ5UemZaawO0A2m4Et6QVf5DEJVO1I2XJM8JVvX9df5gLUAeo9z2uU4O90twd
X6Uds5q6s/v7P4sHta6PWV9/ODfQAhU3Trxkg8L/FJLsWiQfVNodtaRPeOq8HM0w
gsnLqkgqlbghO6bBRe0k0616cgvza+/NZ8qu2oRfpPG/CAIHsC+Hi0SeOoUCgIBi
uqvGwdAhH1a6wXyZZrk8hsQM82yPMMd2FZd5fmdShjJPNewHVSGjbSGa6bamuoXM
DEy518AUQSjxylKjKvb0e/m4i2t7vkTX+khg3kSiv3ZWdrvqvPQrmpCp35XL5uZ5
kCPc9ZluPYF2CIh312weyc+rOyMxefEhA6qOMSeDA32bvHMgK9Bhjj+dAYWa7ikO
jimaTaGMLmMibWNqFF8avSJEAvx5aw8wTUUPjGJ9J/mwqPN6WRxVSxmlZ2HMGJz2
UQMMLNtsDwPgqYi1x3DfbbXLo8g9GJNE4SJjHk1v9EwxwhfuRtKHCTBfJ720qrw6
nTy53Z82G99nNYnyGIYuXdQXJFatUmTvLZjTQYoDu4iB37oJZqc=
=GC6D
-----END PGP SIGNATURE-----

#1142865#22
Date:
2026-08-05 07:57:43 UTC
From:
To:
Control: reassign -1 wireshark 4.6.6-1
[...]

Since the bug has been fixed in wireshark, it should be reassigned
from libfalcosecurity0t64 to wireshark. Otherwise, apt-listbugs
considers that libfalcosecurity0t64 is buggy.

#1142865#35
Date:
2026-08-05 08:05:58 UTC
From:
To:
Control: fixed -1 4.6.6-2

... and mark again as fixed in 4.6.6-2.

#1142865#42
Date:
2026-08-05 08:55:37 UTC
From:
To:
Actually wireshark 4.4.16-0+deb13u1 also crashes with
libfalcosecurity0t64 0.23.2-3. Did falcosecurity-libs break the ABI,
in which case there would actually need to be a soname bump?