CVE-2024-37151: Oisf Suricata Auth Bypass Vulnerability

CVE-2024-37151 Overview

CVE-2024-37151 affects Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). The vulnerability stems from mishandling multiple fragmented packets that share the same IP identification value. Packet reassembly fails under this condition, which allows attackers to bypass detection and prevention policies. The flaw is tracked under [CWE-754] (Improper Check for Unusual or Exceptional Conditions). Affected deployments include sensors using af-packet capture without the defrag option enabled. Upgrading to Suricata 7.0.6 or 6.0.20 resolves the issue.

Critical Impact
Attackers can craft IP fragments to evade Suricata inspection, bypassing IDS/IPS detection signatures and security policies enforced at the network perimeter.

Affected Products

Suricata 7.x prior to 7.0.6
Suricata 6.x prior to 6.0.20
Deployments using af-packet capture without defrag enabled

Discovery Timeline

2024-07-11 - CVE-2024-37151 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-37151

Vulnerability Analysis

Suricata reassembles IP fragments before applying detection rules to the reconstructed payload. The reassembly logic fails to correctly handle multiple in-flight fragmented packets that reuse the same IP ID value. When fragment streams collide on the IP ID, Suricata fails to reconstruct the original datagrams. The engine then forwards or drops fragments without applying signature inspection against the full payload, producing a policy bypass condition. The flaw maps to [CWE-754], reflecting improper handling of an exceptional protocol state that the parser was expected to validate.

Root Cause

The IP defragmentation tracker uses the IP ID field as a key for grouping fragments. The implementation does not safely disambiguate concurrent fragment chains that share an identifier across source-destination pairs and protocol contexts. This leads to lost or mismerged fragment chains. The upstream fixes are tracked in OISF commits 9d5c4273 and aab7f35c, with additional analysis in the OISF Redmine issue tracker.

Attack Vector

An attacker sends crafted fragmented IP traffic across the monitored network. The traffic deliberately reuses IP ID values across overlapping fragment streams. Suricata fails to reassemble the streams, so signatures that depend on inspecting the full Layer 4 or Layer 7 payload do not fire. The attacker then delivers malicious content that would normally be blocked or alerted on by the IDS/IPS. The attack requires no authentication and no user interaction, and operates over the network path.

No public proof-of-concept exploit code has been published. See the OISF security advisory GHSA-qrp7-g66m-px24 for the upstream technical description.

Detection Methods for CVE-2024-37151

Indicators of Compromise

Unusual volumes of fragmented IPv4 traffic with repeated or colliding IP ID values across distinct flows.
Suricata defrag counters showing elevated reassembly failures, timeouts, or tracker exhaustion in stats.log.
Traffic patterns where fragmented sessions reach internal services but no corresponding Layer 7 alerts are generated.

Detection Strategies

Query Suricata eve.json for event_type: stats records and monitor the defrag.ipv4.fragments and defrag.ipv4.reassembled ratios for anomalies.
Compare upstream flow records from switch or tap mirrors against Suricata alert volume to identify inspection gaps.
Run validation traffic with known signatures over fragmented transport to confirm the sensor reassembles and alerts correctly after patching.

Monitoring Recommendations

Forward Suricata eve.json and stats.log into a centralized analytics platform for trend analysis on defrag counters.
Alert on sudden drops in IDS alert volume that correlate with increases in fragmented traffic.
Track sensor versions across the fleet and flag any host still running Suricata below 7.0.6 or 6.0.20.

How to Mitigate CVE-2024-37151

Immediate Actions Required

Upgrade Suricata to version 7.0.6 or 6.0.20, or later, on all sensors.
For sensors using af-packet capture, enable the defrag option in the af-packet configuration block to reduce exposure.
Audit IDS/IPS coverage by replaying fragmented traffic against the sensor and confirming signatures trigger as expected.

Patch Information

OISF released fixes in Suricata 7.0.6 and 6.0.20. The relevant upstream commits are 9d5c4273 and aab7f35c. Debian users should apply the update referenced in the Debian LTS announcement.

Workarounds

Enable kernel-level defragmentation by setting defrag: yes under the af-packet interface configuration in suricata.yaml.
Place upstream network devices that perform full IP reassembly in front of Suricata sensors where feasible.
Restrict or rate-limit fragmented IP traffic at perimeter firewalls when reassembly is not required for legitimate workloads.

bash

# Configuration example: enable defrag for af-packet capture in suricata.yaml
af-packet:
  - interface: eth0
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes