Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list.
Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 10
https://github.com/OISF/suricata/commit/755d6c3061de4d7ba97f0ed31cdc17ab8cab4476
security-advisories@github.com
https://github.com/OISF/suricata/commit/7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4
security-advisories@github.com
https://github.com/OISF/suricata/commit/88adab8bd3d62912941647ab65032d5ec75c893a
security-advisories@github.com
https://github.com/OISF/suricata/commit/9a54a043516e644bb7b9d34117a91977f950a281
security-advisories@github.com
https://github.com/OISF/suricata/commit/bc39274a638d1cca2391cfa4891c8b6c255ff9ce
security-advisories@github.com
https://github.com/OISF/suricata/commit/c8f68b0e4f9e721dca1c9ed6e08597c6964c7ac3
security-advisories@github.com
https://github.com/OISF/suricata/releases/tag/suricata-7.0.17
security-advisories@github.com
https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
security-advisories@github.com
https://github.com/OISF/suricata/security/advisories/GHSA-hvvj-c8xx-9g35
security-advisories@github.com
https://redmine.openinfosecfoundation.org/issues/8629
security-advisories@github.com