OISF Suricata up to 6.0.19/7.0.5 af-packet unusual condition

Summaryinfo

A vulnerability identified as problematic has been detected in OISF Suricata up to 6.0.19/7.0.5. Affected by this vulnerability is an unknown functionality of the component af-packet. Performing a manipulation results in unusual condition. This vulnerability is identified as CVE-2024-37151. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in OISF Suricata up to 6.0.19/7.0.5. This affects some unknown functionality of the component af-packet. The manipulation with an unknown input leads to a unusual condition vulnerability. CWE is classifying the issue as CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. This is going to have an impact on integrity. The summary by CVE is:

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. Upgrade to 7.0.6 or 6.0.20. When using af-packet, enable `defrag` to reduce the scope of the problem.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-37151 since 06/03/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 233594 (Debian dla-4103 : suricata - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.0.20 or 7.0.6 eliminates this vulnerability. Applying the patch 9d5c4273cb7e5ca65f195f7361f0d848c85180e0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (233594). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11
• 6.0.12
• 6.0.13
• 6.0.14
• 6.0.15
• 6.0.16
• 6.0.17
• 6.0.18
• 6.0.19
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion