Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw.
This issue is fixed in version 8.0.6.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 6
https://github.com/OISF/suricata/commit/5449ae170bfce213907d9bab87143a59774ed48f
security-advisories@github.com
https://github.com/OISF/suricata/commit/d62acf5d75a61b76b16815e773408852f41b1975
security-advisories@github.com
https://github.com/OISF/suricata/pull/15807
security-advisories@github.com
https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
security-advisories@github.com
https://github.com/OISF/suricata/security/advisories/GHSA-6qwq-j83r-qp34
security-advisories@github.com
https://redmine.openinfosecfoundation.org/issues/8590
security-advisories@github.com