CVE-2024-23836 - Suricata Vulnerability Causes CPU and Memory Overuse through Malicious Traffic

Suricata, a popular network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine, is used by thousands of organizations worldwide to protect their systems from cyberattacks. However, prior to versions 6..16 and 7..3, a significant vulnerability has been identified that allows attackers to craft traffic causing excessive CPU and memory usage in Suricata. In this post, we will discuss the details of this vulnerability, its potential impact, and how to mitigate or patch the issue.

Vulnerability Details

This vulnerability, identified as CVE-2024-23836, is a resource consumption vulnerability that allows an attacker to craft malicious traffic and cause Suricata to use significantly more CPU and memory resources for processing the traffic than required. This can lead to extreme slow downs in system performance and even denial of service (DoS) in some cases, ultimately making the affected system unusable.

Original References

The details of this vulnerability have been published by the vendor, Suricata, in their changelog, which you can find at the following links:

- Suricata 6..16: https://suricata.readthedocs.io/en/suricata-6..2/releases/6..16.html
- Suricata 7..3: https://suricata.readthedocs.io/en/suricata-7..2/releases/7..3.html

Code Snippet

An attacker can craft malicious traffic to exploit this vulnerability by using specific headers or manipulating traffic in a way that causes the affected protocol app-layer parser to use an excessive amount of resources. The following code snippet demonstrates an example exploit, which we strongly discourage from reproducing or using in a real-world environment:

import socket

target_IP = 'TARGET_IP_ADDRESS'
target_port = 80
packet = b'\x00' * 100

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_IP, target_port))
sock.sendall(packet)
sock.close()

To mitigate this vulnerability, you can take the following steps

1. Upgrade to Suricata 6..16 or 7..3 if you haven't done so already. These versions have patched this vulnerability, and you're strongly advised to upgrade to protect your systems. Links to both versions can be found in the "Original References" section above.
2. Workaround: If you are unable to upgrade immediately, you can disable the affected protocol app-layer parser in your Suricata configuration file (e.g., suricata.yaml). This will prevent the attacker from exploiting this vulnerability.
3. As a temporary measure, you can reduce the stream.reassembly.depth value in your configuration file. This will help minimize the impact of the vulnerability, although upgrading to a patched version is still the recommended solution.

Conclusion

CVE-2024-23836 is a severe vulnerability affecting Suricata versions prior to 6..16 and 7..3. To ensure that your IDS/IPS and security monitoring systems remain secure and functional, it's crucial to upgrade to the latest patched version or apply suitable workarounds to protect your system from potential exploitation. By proactively addressing this vulnerability, you'll help safeguard your organization's network security infrastructure and maintain the integrity of your systems.

Timeline

Published on: 02/26/2024 16:27:57 UTC
Last modified on: 03/07/2024 03:15:06 UTC