Suricata: Multiple denial-of-service vulnerabilities
Suricata versions prior to 8.0.8 contain multiple high-severity vulnerabilities in protocol processing that can lead to memory exhaustion, CPU exhaustion, or service crashes.
Triage facts
Revision 1- Applicability
- Suricata (< 8.0.8)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 03:15 UTC
- Source quality
- A1Likely
Suricata version 8.0.8 addresses several high-severity vulnerabilities affecting protocol inspection. These flaws, identified in internal issues #9085, #9101, #9104, and #9133, allow for denial-of-service conditions through resource exhaustion or application crashes.
Impact
The identified vulnerabilities can cause Suricata to cease inspection or crash when processing specifically crafted network traffic, potentially creating a blind spot in network monitoring. Observed impacts include CPU exhaustion, memory exhaustion, and service termination.
Recommendation
- Upgrade all Suricata deployments to version 8.0.8 or later immediately.
- Review network infrastructure logs for evidence of anomalous spikes in resource usage on Suricata sensors corresponding to the protocol parsing activities (TFTP, SIP, HTTP/2, DoH/2).
Immediate actions
Upgrade Suricata to version 8.0.8 or later
Threat Hunt
Monitor for Suricata service instability or crashes
Data: Systemd/syslog service status logs, Suricata application logs (stats.log)
Mitigations
Upgrade Suricata to version 8.0.8 or later
Issues #9085, #9101, #9104, #9133