defrag: mishandling of overlaps leading to policy bypass

Moderate

victorjulien published GHSA-xvrx-88mv-xcq5

May 7, 2024

Package

suricata

Affected versions

>=6.0.0,>=6.0.18

>=7.0.0,<=7.0.4

Patched versions

6.0.19

7.0.5

Description

Impact

Fragmentation anomalies may be reassembled incorrectly leading to mis-detection of rules.

Patches

Upgrade to 7.0.5 or 6.0.19.

References

https://redmine.openinfosecfoundation.org/issues/6672 (7.0.x)
https://redmine.openinfosecfoundation.org/issues/6673 (7.0.x)
https://redmine.openinfosecfoundation.org/issues/6677 (7.0.x)

Credits

PhD thesis work from Lucas Aubard supervised by Johan Mazel, Gilles Guette and Pierre Chifflier

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N