Описание
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management (Http2ThreadMultiBuf). When inspected HTTP/2 response traffic triggers signature rules that evaluate the http.response_header keyword simultaneously with and without sticky buffer transformations, the HTTP/2 state handler improperly reuses allocated memory buffers. An unauthenticated remote attacker can exploit this flaw by transmitting crafted HTTP/2 server response frames across monitored network segments, leading to memory corruption, a daemon crash resulting in Denial of Service (DoS), or potentially arbitrary code execution within the context of the Suricata process. This issue affects Suricata versions prior to 8.0.7.
Отчет
A flaw was found in Suricata's HTTP/2 engine (Http2ThreadMultiBuf). When HTTP/2 response traffic is inspected by rules mixing http.response_header with and without transformations, a use-after-free condition occurs. A remote, unauthenticated attacker can exploit this by sending crafted HTTP/2 responses through inspected paths, causing a daemon crash or potentially arbitrary code execution with the privileges of the Suricata process.
Меры по смягчению последствий
Temporarily disable or refactor detection rules that utilize the http.response_header keyword with transformations, or disable HTTP/2 protocol parsing by setting app-layer.protocols.http2.enabled: false in /etc/suricata/suricata.yaml and restart the Suricata service.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a ...
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
EPSS
9.8 Critical
CVSS3