CVE-2024-28870: Oisf Suricata DOS Vulnerability

CVE-2024-28870 Overview

CVE-2024-28870 is a resource exhaustion vulnerability in Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). The flaw resides in the engine's Secure Shell (SSH) banner parser. When Suricata processes an overly long SSH banner, it consumes excessive CPU resources and generates excessive alert log volume. Remote attackers can trigger the condition without authentication by sending crafted SSH traffic across monitored network segments. The issue is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling]. OISF released fixed builds in Suricata 6.0.17 and 7.0.4.

Critical Impact
Unauthenticated attackers can degrade Suricata sensor performance and flood alerting pipelines by transmitting oversized SSH banners across monitored traffic.

Affected Products

OISF Suricata versions prior to 6.0.17
OISF Suricata 7.x versions prior to 7.0.4
Deployments using Suricata as an IDS, IPS, or NSM sensor with SSH protocol parsing enabled

Discovery Timeline

2024-04-03 - CVE-2024-28870 published to NVD
2025-04-28 - Last updated in NVD database

Technical Details for CVE-2024-28870

Vulnerability Analysis

The vulnerability is a denial-of-service condition affecting Suricata's SSH application-layer parser. Suricata inspects SSH protocol traffic to extract banner strings used for protocol identification, logging, and rule matching. The parser does not enforce reasonable bounds on banner length, so processing an overly long banner causes inefficient CPU usage in the inspection path.

The secondary effect amplifies the impact. Each oversized banner can produce excessive alert records written to eve.json and other configured outputs. High log volume saturates disk I/O, downstream SIEM ingestion pipelines, and analyst workflows. The vulnerability targets the availability of the monitoring sensor rather than confidentiality or integrity of inspected traffic.

Root Cause

The root cause is missing input length validation in the SSH banner parsing logic, classified under [CWE-770]. Suricata reads and processes banner data without applying a strict upper bound, allowing input-controlled work to dominate inspection threads. The associated alerting logic compounds the issue by emitting log records proportional to the malformed input.

Attack Vector

The vector is network-based and requires no authentication or user interaction. An attacker positioned to send traffic that traverses a Suricata sensor crafts SSH sessions containing abnormally long banner strings. The sensor parses each session, exhausts CPU cycles, and writes large volumes of alert data. Repeated sessions can starve other inspection work, drop packets, and degrade IDS/IPS coverage during the attack window.

No verified public proof-of-concept code is available. Refer to the OISF GitHub Security Advisory GHSA-mhhx-xw7r-r5c8 for vendor technical details.

Detection Methods for CVE-2024-28870

Indicators of Compromise

Sudden spikes in suricata process CPU utilization on sensor hosts without proportional traffic volume changes
Rapid growth in eve.json or alert log size, particularly entries tied to SSH protocol events
Repeated SSH sessions from the same source containing banner strings exceeding several kilobytes
Packet drops or capture statistics indicating the sensor cannot keep up with monitored throughput

Detection Strategies

Inspect SSH banner lengths in packet captures and flag sessions where the banner exceeds the RFC 4253 practical limit of 255 bytes per line
Correlate Suricata performance counters (capture.kernel_drops, decoder.pkts) with alert ingestion rates to detect inspection backpressure
Hunt across log telemetry for clusters of SSH alerts originating from a single source within short time windows

Monitoring Recommendations

Track Suricata version inventory and flag sensors running builds earlier than 6.0.17 or 7.0.4
Alert on disk utilization thresholds for partitions hosting Suricata log output
Forward sensor host metrics and Suricata stats.log data to a centralized analytics platform for trend analysis

How to Mitigate CVE-2024-28870

Immediate Actions Required

Upgrade Suricata to version 6.0.17, 7.0.4, or later on every IDS, IPS, and NSM sensor
Audit log storage capacity and rotate or archive oversized eve.json files generated before patching
Review network ACLs to restrict untrusted sources from reaching internal SSH services monitored by Suricata

Patch Information

OISF addressed the vulnerability in Suricata 6.0.17 and 7.0.4. The patched releases enforce parsing limits on SSH banner length and reduce alert generation tied to malformed banners. See the OISF Security Advisory GHSA-mhhx-xw7r-r5c8 for release notes and upgrade guidance.

Workarounds

Disable the SSH application-layer parser in suricata.yaml under app-layer.protocols.ssh if SSH inspection is not required
Apply rate limiting or BPF filters at the sensor capture interface to drop SSH traffic from untrusted segments until patching is complete
Tune alert output thresholds and enable log rotation policies to contain disk impact during exploitation attempts

bash

# Disable Suricata SSH parsing as a temporary workaround
# Edit /etc/suricata/suricata.yaml
app-layer:
  protocols:
    ssh:
      enabled: no

# Reload Suricata configuration
sudo systemctl reload suricata

# Verify running version is patched
suricata --build-info | grep -i version