CVE-2024-23836

crafted traffic can cause denial of service

CVSS 7.5 HIGHEPSS 1.2%CWE-770

In short

An attacker can send specially crafted network traffic that forces Suricata (a security monitoring tool) to use excessive CPU and memory, causing it to slow down or stop working entirely.

Technical detail

Suricata versions before 6.0.16 and 7.0.3 are vulnerable to a denial-of-service attack via crafted traffic that triggers inefficient resource consumption in protocol parsing and stream reassembly; exploitation requires only the ability to send network traffic to the monitored interface, resulting in system unavailability or severe performance degradation.

Summary generated and translated by AI from the official description.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extreme slow downs and denial of service. This vulnerability is patched in 6.0.16 or 7.0.3. Workarounds include disabling the affected protocol app-layer parser in the yaml and reducing the `stream.reassembly.depth` value helps reduce the severity of the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

OISF · suricata

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References