CVE-2024-38534
Suricata modbus: txs without responses are never freed
In short
Suricata can accumulate unlimited resources when processing specially crafted Modbus network traffic, potentially causing the system to run out of memory or become unresponsive. This happens because incomplete Modbus requests are not properly cleaned up.
Technical detail
Suricata's Modbus parser fails to free transaction structures (txs) when responses are absent, allowing an attacker to send crafted Modbus traffic that triggers unbounded resource accumulation within a flow. The vulnerability is mitigated by limiting stream.reassembly.depth; fixed in version 7.0.6.
Summary generated and translated by AI from the official description.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimited resource accumulation within a flow. Upgrade to 7.0.6. Set a limited stream.reassembly.depth to reduce the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · suricataWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →